Cryptographic processing system, key generation device, encryption device, decryption device, cryptographic processing method, and cryptographic processing program

ABSTRACT

The object is to provide a secure functional encryption scheme having many cryptographic functions. An access structure is constituted by applying the inner-product of attribute vectors to a span program. The access structure has a degree of freedom in design of the span program and design of the attribute vectors, thus having a large degree of freedom in design of access control. A functional encryption process is implemented by imparting the access structure to each of a ciphertext and a decryption key.

TECHNICAL FIELD

The present invention relates to a functional encryption (FE) scheme.

BACKGROUND ART

Non-Patent Literatures 3 to 6, 10, 12, 13, 15, and 18 describe an ID(Identity)-based encryption (IBE) scheme which constitutes one class ofthe functional encryption scheme.

CITATION LIST Non-Patent Literature

-   Non-Patent Literature 1: Beimel, A., Secure schemes for secret    sharing and key distribution. PhD Thesis, Israel Institute of    Technology, Technion, Haifa, Israel, 1996-   Non-Patent Literature 2: Bethencourt, J., Sahai, A., Waters, B.:    Ciphertext policy attribute-based encryption. In: 2007 IEEE    Symposium on Security and Privacy, pp. 321•34. IEEE Press (2007)-   Non-Patent Literature 3: Boneh, D., Boyen, X.: Efficient    selective-ID secure identity based encryption without random    oracles. In: Cachin, C., Camenisch, J. (eds.) EUROCRYPT 2004. LNCS,    voL 3027, pp. 223•38. Springer Heidelberg (2004)-   Non-Patent Literature 4: Boneh, D., Boyen, X.: Secure identity based    encryption without random oracles. In: Franklin, M. K. (ed.)    CRYPTO 2004. LNCS, vol. 3152, pp. 443•59. Springer Heidelberg (2004)-   Non-Patent Literature 5: Boneh, D., Boyen, X., Goh, E.: Hierarchical    identity based encryption with constant size ciphertext. In:    Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 440•56.    Springer Heidelberg (2005)-   Non-Patent Literature 6: Boneh, D., Franklin, M.: Identity-based    encryption from the Weil pairing. In: Kilian, J. (ed.) CRYPTO2001.    LNCS, vol. 2139, pp. 213•29. Springer Heidelberg (2001)-   Non-Patent Literature 7: Boneh, D., Hamburg, M.: Generalized    identity based and broadcast encryption scheme. In: Pieprzyk, J.    (ed.) ASIACRYPT 2008. LNCS, vol. 5350, pp. 455•70. Springer    Heidelberg (2008)-   Non-Patent Literature 8: Boneh, D., Katz, J., Improved efficiency    for CCA-secure cryptosystems built using identity based encryption.    RSA-CT 2005, LNCS, Springer Verlag (2005)-   Non-Patent Literature 9: Boneh, D., Waters, B.: Conjunctive, subset,    and range queries on encrypted data. In: Vadhan, S. P. (ed.)    TCC 2007. LNCS, vol. 4392, pp. 535•54. Springer Heidelberg (2007)-   Non-Patent Literature 10: Boyen, X., Waters, B.: Anonymous    hierarchical identity-based encryption (without random oracles). In:    Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 290•07. Springer    Heidelberg (2006)-   Non-Patent Literature 11: Canetti, R., Halevi S., Katz J.,    Chosen-ciphertext security from identity-based encryption.    EUROCRYPT2004, LNCS, Springer-Verlag (2004)-   Non-Patent Literature 12: Cocks, C.: An identity based encryption    scheme based on quadratic residues. In: Honary, B. (ed.) IMA1 nt.    Conf. LNCS, vol. 2260, pp. 360•63. Springer Heidelberg (2001)-   Non-Patent Literature 13: Gentry, C.: Practical identity-based    encryption without random oracles. In: Vaudenay, S. (ed.)    EUROCRYPT 2006. LNCS, vol. 4004, pp. 445•64. Springer Heidelberg    (2006)-   Non-Patent Literature 14: Gentry, C., Halevi, S.: Hierarchical    identity-based encryption with polynomially many levels. In:    Reingold, O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 437•56. Springer    Heidelberg (2009)-   Non-Patent Literature 15: Gentry, C., Silverberg, A.: Hierarchical    ID-based cryptography. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS,    vol. 2501, pp. 548•66. Springer Heidelberg (2002)-   Non-Patent Literature 16: Goyal, V., Pandey, O., Sahai, A., Waters,    B.: Attribute-based encryption for fine-grained access control of    encrypted data. In: ACM Conference on Computer and Communication    Security 2006, pp. 89.8, ACM (2006)-   Non-Patent Literature 17: Groth, J., Sahai, A.: Efficient    non-interactive proof systems for bilinear groups. In: Smart, N. P.    (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 415•32. Springer    Heidelberg (2008)-   Non-Patent Literature 18: Horwitz, J., Lynn, B.: Towards    hierarchical identity-based encryption. In: Knudsen, L. R. (ed.)    EUROCRYPT 2002. LNCS, vol. 2332, pp. 466•81. Springer Heidelberg    (2002)-   Non-Patent Literature 19: Katz, J., Sahai, A., Waters, B.: Predicate    encryption supporting disjunctions, polynomial equations, and inner    products. In: Smart, N. P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965,    pp. 146.62. Springer Heidelberg (2008)-   Non-Patent Literature 20: Lewko, A., Okamoto, T., Sahai, A.,    Takashima, K., Waters, B.: Fully secure functional encryption:    Attribute-based encryption and (hierarchical) inner product    encryption, In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110,    pp. 62-91. Springer, Heidelberg (2010)-   Non-Patent Literature 21: Lewko, A. B., Waters, B.: Fully secure    HIBE with short ciphertexts. ePrint, IACR,    http://eprint.iacr.org/2009/482-   Non-Patent Literature 22: Okamoto, T., Takashima, K.: Homomorphic    encryption and signatures from vector decomposition. In:    Galbraith, S. D., Paterson, K. G. (eds.) Pairing 2008. LNCS, vol.    5209, pp. 57•4. Springer Heidelberg (2008)-   Non-Patent Literature 23: Okamoto, T., Takashima, IC: Hierarchical    predicate encryption for Inner-Products, In: ASIACRYPT 2009,    Springer Heidelberg (2009)-   Non-Patent Literature 24: Okamoto, T., Takashima, K.: Fully Secure    Functional Encryption with General Relations from the Decisional    Linear Assumption, In: CRYPTO 2010, LNCS vol. 6223, pp. 191-208.    Springer Heidelberg (2010)-   Non-Patent Literature 25: Ostrovsky, R., Sahai, A., Waters, B.:    Attribute-based encryption with non-monotonic access structures. In:    ACM Conference on Computer and Communication Security 2007, pp.    195•03, ACM (2007)-   Non-Patent Literature 26: Pirretti, M., Traynor, P., McDaniel, P.,    Waters, B.: Secure attribute-based systems. In: ACM Conference on    Computer and Communication Security 2006, pp. 99.12, ACM, (2006)-   Non-Patent Literature 27: Sahai, A., Waters, B.: Fuzzy    identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005.    LNCS, vol. 3494, pp. 457•73. Springer Heidelberg (2005)-   Non-Patent Literature 28: Shi, E., Waters, B.: Delegating capability    in predicate encryption systems. In: Aceto, L., Damgard, I.,    Goldberg, L. A., Halldosson, M. M., Ingofsdotir, A., Walukiewicz, I.    (eds.) ICALP (2) 2008. LNCS, vol. 5126, pp. 560•78. Springer    Heidelberg (2008)-   Non-Patent Literature 29: Waters, B.: Efficient identity based    encryption without random oracles. Eurocrypt 2005, LNCS No. 3152,    pp. 443•59. Springer Verlag, 2005.-   Non-Patent Literature 30: Waters, B.: Ciphertext-policy    attribute-based encryption: an expressive, efficient, and provably    secure realization. ePrint, IACR, http://eprint.iacr.org/2008/290-   Non-Patent Literature 31: Waters, B.: Dual system encryption:    Realizing fully secure IBE and HIBE under simple assumptions. In:    Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 619•36. Springer    Heidelberg (2009)

SUMMARY OF INVENTION Technical Problem

It is an object of the present invention to provide a secure functionalencryption scheme having diversified cryptographic functions.

Solution to Problem

A cryptographic processing system according to the present inventionincludes a key generation device, an encryption device, and a decryptiondevice, and serves to execute a cryptographic process using a basis B₀and a basis B₀*, a basis B_(t) ^(KP) and a basis B*_(t) ^(KP) for eachinteger t=1, . . . , d^(KP) (d^(KP) is an integer of 1 or more), and abasis B_(t) ^(CP) and a basis B*_(t) ^(CP) for each integer t=1, . . . ,d^(CP) (d^(CP) is an integer of 1 or more),

wherein the key generation device includes

a first KP information input part which takes as input, a variableρ^(KP)(i) for each integer i=1, . . . , L^(KP) (L^(KP) is an integer of1 or more), which variable ρ^(KP)(i) is either one of a positive tuple(t, v^(→) _(i) ^(KP)) and a negative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP): =(v_(i,i′) ^(KP))(i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) isan integer of 1 or more), and a predetermined matrix M^(KP) havingL^(KP) rows and r^(KP) columns (r^(KP) is an integer of 1 or more),

a first CP information input part which takes as input, an attribute setΓ^(CP) having the identification information t and an attribute vectorx^(→) _(t) ^(CP):=(x_(t,i′) ^(CP)) (i′=1, . . . , n_(t) ^(CP) wheren_(t) ^(CP) is an integer of 1 or more) for at least one integer t=1, .. . , d^(CP),

a main decryption key generation part which generates an element k*₀ bysetting a value −s₀ ^(KP) (s₀ ^(KP):=h^(→KP)·(f^(→KP))^(T) where h^(→KP)and f^(→KP) are vectors each having r^(KP) pieces of elements) as acoefficient for a basis vector b*_(0,p) (p is a predetermined value) ofthe basis B*₀, by setting a random number δ^(CP) as a coefficient for abasis vector b*_(0,p′) (p′ is a predetermined value different fromprescribed p), and by setting a predetermined value κ as a coefficientfor a basis vector b*_(0,q) (q is a predetermined value different fromthe prescribed p and prescribed p′),

a KP decryption key generation part which generates an element k*_(i)^(KP) for each integer i=1 . . . , L^(KP), based on a column vector(s^(→KP))^(T):=(s₁ ^(KP), . . . , s_(i) ^(KP)):=M^(KP)·(f^(→KP))^(T)(i=L^(KP)) generated based on prescribed f^(→KP) and the matrix M^(KP)which is inputted by the first KP information input part; and a randomnumber θ_(i) ^(KP) (i=1, . . . , L^(KP)), the KP decryption keygeneration part being configured to generate the element k*_(i) ^(KP),when the variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP) is apositive tuple (t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)+θ_(i)^(KP)v_(i,1) ^(KP) as a coefficient for a basis vector b*_(t,1) ^(KP) ofthe basis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for a basis vector b*_(t,i′) ^(KP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(KP), and when the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for the basis vector b*_(t,i′) ^(KP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(KP), and

a CP decryption key generation part which generates an element k*_(t)^(CP) concerning each identification information t included in theattribute set Γ^(CP) inputted by the first CP information input part,the CP decryption key generation part being configured to generate theelement k*_(t) ^(CP) by setting x_(t,i′) ^(CP) multiplied by the randomnumber δ^(CP) as a coefficient for a basis vector b*_(t,i′) ^(CP) (i′=1,. . . , n_(t) ^(CP)) of the basis B*_(t) ^(CP),

wherein the encryption device includes

a second KP information input part which takes as input, an attributeset Γ^(KP) having the identification information t and an attributevector x^(→) _(t) ^(KP):=1, . . . , n_(t) ^(KP)) for at least oneinteger t=1, . . . , d^(KP),

a second CP information input part which takes as input, a variableρ^(CP)(i) for each integer i=1, . . . , L^(CP) (L^(CP) is an integer of1 or more), which variable ρ^(CP)(i) is either one of a positive tuple(t, v^(→) _(i) ^(CP)) and a negative tuple

(t, v^(→) _(i) ^(CP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector v^(→) _(i)^(CP):=(v_(i,i′) ^(CP))(i′=1, . . . , n_(t) ^(CP)), and a predeterminedmatrix M^(CP) having L^(CP) rows and r^(CP) columns (r^(CP) is aninteger of 1 or more),

a main encrypted data generation part which generates an element c₀ bysetting a random number ω^(KP) as a coefficient for a basis vectorb_(0,p′) of the basis B₀, by setting a value −s₀ ^(CP) (s₀^(CP):=h^(→CP)·(f^(→CP))^(T) where h^(→CP) and f^(→CP) are vectors eachhaving r^(CP) pieces of elements) as a coefficient for a basis vectorb_(0,p′) of the basis B₀, and by setting a random number ζ as acoefficient for a basis vector b_(0,q),

a KP encrypted data generation part which generates an element c_(t)^(KP) concerning each identification information t included in theattribute set Γ^(KP) inputted by the second KP information input part,the KP encrypted data generation part being configured to generate theelement c_(t) ^(KP) by setting x_(t,i′) ^(KP) multiplied by the randomnumber ω^(KP) as a coefficient for a basis vector b_(t,i′) ^(KP) (i′=1,. . . , n_(t)) of the basis B_(t) ^(KP), and

a CP encrypted data generation part which generates an element c_(i)^(CP) for each integer i=1 . . . , L^(CP), based on a column vector(s^(→CP))^(T):=(s₁ ^(CP), . . . , s_(i) ^(CP))^(T):=M^(CP)·(f^(→CP))^(T)(i=L^(CP)) generated based on the prescribed f^(→CP) and the matrixM^(CP) which is inputted by the second CP information input part; and arandom number θ_(i) ^(CP) (i=1, . . . , L^(CP)), the CP encrypted datageneration part being configured to generate the element c_(i) ^(CP),when the variable ρ^(CP)(i) for each integer i=1, . . . , L^(CP) is apositive tuple (t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)+θ_(i)^(CP)v_(i,1) ^(CP) as a coefficient for a basis vector b_(t,1) ^(CP) ofthe basis B_(t) ^(CP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for a basis vector b_(t,i′) ^(CP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for the basis vector b_(t,i′) ^(CP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(CP), and

wherein the decryption device includes

a data acquisition part which acquires encrypted data ct_((ΓKP,SCP))including the element c₀ generated by the main encrypted data generationpart, the element c_(t) ^(KP) generated by the KP encrypted datageneration part, the element c_(i) ^(CP) generated by the CP encrypteddata generation part, the attribute set Γ^(KP), and the variableρ^(CP)(i), a decryption key acquisition part which acquires a decryptionkey sk_((SKP,ΓCP)) including the element k*₀ generated by the maindecryption key generation part, the element k*_(i) ^(KP) generated bythe KP decryption key generation part, the element k*_(t) ^(CP)generated by the CP decryption key generation part, the variableρ^(KP)(i), and the attribute set Γ^(CP),

a KP complementary coefficient calculation part which, based on theattribute set Γ^(KP) included in the encrypted data ct_((ΓKP,SCP))acquired by the data acquisition part, and the variable ρ^(KP)(i)included in the decryption key sk_((SKP,ΓCP)) acquired by the decryptionkey acquisition part, specifies, among integers i=1, . . . , L^(KP), aset I^(KP) of i for which the variable ρ^(KP)(i) is a positive tuple (t,v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i) ^(KP) ofthe positive tuple and x^(→) _(t) ^(KP) included in Γ^(KP) indicated byidentification information t of the positive tuple becomes 0, and i forwhich the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(KP) of the negative tuple and x^(→) _(i) ^(KP) included in Γ^(KP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(KP) withwhich a total of α_(i) ^(KP)M_(i) ^(KP) for i included in the set I^(KP)specified becomes prescribed h^(→KP),

a CP complementary coefficient calculation part which, based on thevariable ρ^(CP)(i) concerning each integer i=1, . . . , L^(CP) includedin the encrypted data ct_((ΓKP,SCP)), and the attribute set Γ^(CP)included in the decryption key sk_((SKP,ΓCP)), specifies, among integersi=I, . . . , L^(CP), a set I^(CP) of i for which the variable ρ^(CP)(i)is a positive tuple (t, v^(→) _(i) ^(CP)) and with which aninner-product of v^(→) _(i) ^(CP) of the positive tuple and x^(→) _(t)^(CP) included in Γ^(CP) indicated by identification information t ofthe positive tuple becomes 0, and i for which the variable ρ^(CP)(i) isa negative tuple

(t, v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i)^(CP) of the negative tuple and x^(→) _(t) ^(CP) included in Γ^(CP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(CP) withwhich a total of α_(i) ^(CP)M_(i) ^(CP) for i included in the set I^(CP)specified becomes the prescribed h^(→CP), and

a pairing operation part which calculates a value K by conducting apairing operation indicated in Formula 1 for the elements c₀, c_(t)^(KP), and c_(i) ^(CP) included in the encrypted data ct_((ΓKP,SCP)),and the elements k*₀, k*_(i) ^(KP), and k*_(t) ^(CP) included in thedecryption key sk_((SKP,ΓCP)), based on the set I^(KP) specified by theKP complementary coefficient calculation part, on the complementarycoefficient α_(i) ^(KP) calculated by the KP complementary coefficientcalculation part, on the set I^(CP) specified by the CP complementarycoefficient calculation part, and on the complementary coefficient α_(i)^(CP) calculated by the CP complementary coefficient calculation part.

[Formula  1]$K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{\alpha_{i}^{KP} \cdot {\prod\limits_{\quad{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}} \right)} \cdot {\quad{\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}\; {{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}{\alpha_{i}^{CP} \cdot {\quad{\quad{\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}\; {{e\left( {c_{t}^{CP}, k_{i}^{*{CP}}} \right)}{\quad{\alpha_{i}^{CP}/\left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}}}}}}}}}}}}}$

Advantageous Effects of Invention

In the cryptographic processing system according to the presentinvention, an access structure is embedded in each of the decryption keyand the ciphertext, to implement diversified cryptographic functions.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is an explanatory drawing of a matrix M̂.

FIG. 2 is an explanatory drawing of a matrix M_(δ).

FIG. 3 is an explanatory drawing of s₀.

FIG. 4 is an explanatory drawing of s^(→T).

FIG. 5 is a configuration diagram of a cryptographic processing system10 which executes a unified-policy functional encryption scheme.

FIG. 6 is a function block diagram showing the function of a keygeneration device 100.

FIG. 7 is a function block diagram showing the function of an encryptiondevice 200.

FIG. 8 is a function block diagram showing the function of a decryptiondevice 300.

FIG. 9 is a flowchart showing the process of Setup algorithm.

FIG. 10 is a flowchart showing the process of KeyGen algorithm.

FIG. 11 is a flowchart showing the process of Enc algorithm.

FIG. 12 is a flowchart showing the process of Dec algorithm.

FIG. 13 is a diagram showing an example of the hardware configuration ofeach of the key generation device 100, encryption device 200, anddecryption device 300.

DESCRIPTION OF EMBODIMENTS

Embodiments of the present invention will be described hereinafter withreference to the accompanying drawings.

In the following description, the processing device is, for example, aCPU 911 (to be described later). The storage device is, for example, aROM 913, a RAM 914, or a magnetic disk 920 (each will be describedlater). The communication device is, for example, a communication board915 (to be described later). The input device is, for example, akeyboard 902 (to be described later) or the communication board 915.Namely, the processing device, the storage device, the communicationdevice, and the input device are hardware.

The notation in the following description will be explained.

When A is a random variable or distribution, Formula 101 denotes that yis randomly selected from A according to the distribution of A. Namely,in Formula 101, y is a random number.

$\begin{matrix}{y\overset{R}{}A} & \left\lbrack {{Formula}\mspace{14mu} 101} \right\rbrack\end{matrix}$

When A is a set, Formula 102 denotes that y is uniformly selected fromA. Namely, in Formula 102, y is a uniform random number.

$\begin{matrix}{y\overset{U}{}A} & \left\lbrack {{Formula}\mspace{14mu} 102} \right\rbrack\end{matrix}$

Formula 103 denotes that y is a set, defined or substituted by z.

y:=z  [Formula 103]

When a is a fixed value, Formula 104 denotes an event that a machine(algorithm) A outputs a on input x.

A(x)→a  [Formula 104]

For example,

A(x)→1

Formula 105, namely, F_(q), denotes a finite field of order q.

_(q)  [Formula 105]

A vector symbol denotes a vector representation over the finite fieldF_(q). Namely, Formula 106 is established.

{right arrow over (x)} denotes

(x ₁ , . . . ,x _(n))ε

_(q) ^(n)  [Formula 106]

Formula 107 denotes the inner-product, indicated by Formula 109, of twovectors x^(→) and y^(→) indicated in Formula 108.

{right arrow over (x)}·{right arrow over (v)}  [Formula 107]

{right arrow over (x)}=(x ₁ , . . . ,x _(n)),

{right arrow over (v)}=(v ₁ , . . . ,v _(n))  [Formula 108]

Σ_(i=1) ^(n) x _(i) v _(i)  [Formula 109]

Note that X^(T) denotes the transpose of matrix M.

Note that for bases B and B* indicated in Formula 110, Formula 111 isestablished.

:=(b ₁ , . . . ,b _(N)),

:=(b* ₁ , . . . ,b* _(N))  [Formula 110]

(x ₁ , . . . ,x _(N))

_(:=Σ) _(i=1) ^(N) x _(i) b _(i),

(y ₁ , . . . ,y _(N))

_(*:=Σ) _(i=1) ^(N) y _(i) b _(i)  [Formula 111]

Note that e^(→) _(t,j) ^(KP) and e^(→) _(t,j) ^(CP) respectivelyindicate normal basis vectors shown in Formula 112.

$\begin{matrix}{{{\overset{\rightarrow{KP}}{e_{t,j}}\text{:}\mspace{14mu} \left( {\overset{\overset{j - 1}{}}{0\mspace{14mu} \ldots \mspace{14mu} 0},1,\overset{\overset{n_{t} - j}{}}{0\mspace{14mu} \ldots \mspace{14mu} 0}} \right)} \in _{q}^{n_{t}^{KP}}}{{{{for}\mspace{14mu} j} = 1},\ldots \mspace{14mu},n_{t}^{KP},{{\overset{\rightarrow{CP}}{e_{t,j}}\text{:}\mspace{14mu} \left( {\overset{\overset{j - 1}{}}{0\mspace{14mu} \ldots \mspace{14mu} 0},1,\overset{\overset{n_{t} - j}{}}{0\mspace{14mu} \ldots \mspace{14mu} 0}} \right)} \in _{q}^{n_{t}^{CP}}}}{{{{for}\mspace{14mu} j} = 1},\ldots \mspace{14mu},n_{t}^{CP},}} & \left\lbrack {{Formula}\mspace{14mu} 112} \right\rbrack\end{matrix}$

In the following description, ntCP in F_(q) ^(ntCP) represents n_(t)^(CP).

Likewise, in a decryption key sk_((SKP,ΓCP)), SKP represents S^(KP), andΓCP represents Γ^(CP). In encrypted data ct_((ΓKP,SCP)), ΓKP representsΓ^(KP), and SCP represents S^(CP).

Likewise, in param_(V0), V0 represents V₀. In param_(VtKP), VtKPrepresents V_(t) ^(KP). In param_(VtCP), VtCP represents V_(t) ^(CP).

Likewise, when “δi,j” is indicated to include a superscript, δi,j isδ_(i,j).

When “→” indicating a vector is attached to a subscript or superscript,“→” is attached as a superscript to the subscript or superscript.

In the following description, a cryptographic process includes a keygeneration process, an encryption process, and a decryption process.

Embodiment 1

This embodiment describes a basic concept for implementing the“functional encryption scheme, and a structure of the functionalencryption.

First, the functional encryption will be briefly explained.

Second, a space having a rich mathematical structure called “dualpairing vector spaces (DPVS)” which is a space for implementing thefunctional encryption will be described.

Third, a concept for implementing the functional encryption will bedescribed. Here, “span program”, “the inner-product of attributevectors, and an access structure”, and “secret distribution scheme(secret sharing scheme)” will be described.

Fourth, a “functional encryption scheme” according to this embodimentwill be described. In this embodiment, a “unified-policy functionalencryption (UP-FE) scheme” will be described. Initially, the basicstructure of the “unified-policy functional encryption scheme” will bedescribed. Subsequently, the basic structure of a “cryptographicprocessing system 10” which implements the “unified-policy functionalencryption scheme” will be described. Then, a “unified-policy functionalencryption scheme” and a “cryptographic processing system 10” accordingto this embodiment will be described in detail.

<1. Functional Encryption Scheme>

The functional encryption scheme is an encryption scheme that providesmore sophisticated and flexible relations between an encryption key (ek)and a decryption key (dk).

According to the functional encryption scheme, an attribute x and anattribute y are set in an encryption key and a decryption key,respectively. A decryption key dk_(v):=(dk,v) can decrypt a ciphertextencrypted with an encryption key ek_(x):=(ek,x) only if R(x,v) holds forrelation R.

The functional encryption scheme has various applications in the areasof access control of databases, mail services, contents distribution,and the like (see Non-Patent Literatures 2, 7, 9, 16, 19, 25 to 28, and30).

When R is an equality relation, that is, when R(x, v) holds only if x=v,the functional encryption scheme is the ID-based encryption scheme.

As a more general class of functional encryption scheme than theID-based encryption scheme, attribute-based encryption schemes have beenproposed.

According to the attribute-based encryption schemes, each attributewhich is set for an encryption key and decryption key is a tuple ofattributes. For example, attributes which are set for an encryption keyand decryption key are X:=(x₁, . . . , x_(d)) and V:=(v₁, . . . ,v_(d)), respectively.

The component-wise equality relations for attribute components (e.g.,{x_(t)=v_(t)}_(tε{1, . . . , d})) are input to an access structure S,and R(X, V) holds if and only if the input is accepted by the accessstructure S. Namely, the ciphertext encrypted with the encryption keycan be decrypted with the decryption key.

If the access structure S is embedded into the decryption key dk_(v),the attribute-based encryption (ABE) scheme is called key-policy ABE(KP-ABE). If the access structure S is embedded into a ciphertext, theattribute-based encryption (ABE) scheme is called ciphertext-policy ABE(CP-ABE). If the access structure S is embedded into each of thedecryption key dk, and the ciphertext, the attribute-based encryption(ABE) scheme is called unified-policy ABE (UP-ABE).

Inner-product encryption (IPE) described in Non-Patent Literature 19 isalso a class of functional encryption, where each attribute for theencryption key and decryption key is a vector over a field or ring. Forexample, x^(→):=(x₁, . . . , x_(n)) εF_(q) ^(n) and v^(→):=(v₁, . . . ,v_(n)) εF_(q) ^(n) are set for the encryption key and decryption key.R(x^(→), v^(→)) holds if and only if x^(→)·v^(→)=0.

<2. Dual Pairing Vector Spaces>

First, symmetric bilinear pairing groups will be described.

The symmetric bilinear pairing groups (q, G, G^(T), g, e) are a tuple ofa prime q, a cyclic additive group G of order q and a cyclicmultiplicative group G^(T) of order q, g≠0 εG, and a polynomial-timecomputable nondegenerate bilinear pairing e: G×G→ G_(T). Thenondegenerate bilinear pairing signifies e(sg, tg)=e(g, g)^(st), ande(g, g)≠1.

In the following description, let Formula 113 be an algorithm that takesinput 1^(λ) and outputs a value of a parameter param_(G):=(q, G, G_(T),g, e) of bilinear pairing groups with a security parameter λ.

G _(bpg)  [Formula 113]

Dual pairing vector spaces will now be described.

Dual pairing vector spaces (q, V, G_(T), A, e) can be constituted by adirect product of symmetric bilinear pairing groups (param_(G):=(q, G,G_(T), g, e)). The dual pairing vector spaces (q, V, G_(T), A, e) are atuple of a prime q, an N-dimensional vector space V over F_(q) indicatedin Formula 114, a cyclic group G_(T) of the order q, and a canonicalbasis A:=(a₁, . . . , a_(N)) of the space V, and have the followingoperations (1) and (2) where a_(i) is as indicated in Formula 115.

$\begin{matrix}{:=\overset{\overset{N}{}}{ \times \ldots \times }} & \left\lbrack {{Formula}\mspace{14mu} 114} \right\rbrack \\{a_{i}:=\left( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{14mu},0},g,\overset{\overset{N - i}{}}{0,\ldots \mspace{14mu},0}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 115} \right\rbrack\end{matrix}$

Operation (1): Nondegenerate Bilinear Pairing

The pairing on the space V is defined by Formula 116.

e(x,y):=Π_(i=1) ^(N) e(G _(i) H _(i))ε

_(T)  [Formula 116]

where(G₁, . . . , G_(N)):=xε

,(H₁, . . . , H_(N)):=yε

This is nondegenerate bilinear, i.e., e(sx, ty)=e(s, y)^(st) and if e(x,y)=1 for all y εV, then x=0. For all i and j, e(a_(i), a_(j))=e(g,g)^(δi,j) where δ_(i,j)=1 if i=j, and δ_(i,j)=0 if i≠j. Also, e(g,g)≠1εG_(T).

Operation (2): Distortion Maps

Linear transformation φ_(i,j) on the space V indicated in Formula 117can achieve Formula 118.

φ_(i,j)(a _(j))=a _(i),

if

k≠j then φ_(i,j)(a _(k))=0  [Formula 117]

$\begin{matrix}{{{\varphi_{i,j}(x)}:=\left( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{14mu},0},g_{j},\overset{\overset{N - i}{}}{0,\ldots \mspace{14mu},0}} \right)}{{{Note}\mspace{14mu} {{that}\left( {g_{1},{\ldots \mspace{14mu} g_{N}}} \right)}}:=x}} & \left\lbrack {{Formula}\mspace{14mu} 118} \right\rbrack\end{matrix}$

Linear transformation φ_(i,j) will be called “distortion maps”.

In the following description, let Formula 119 be an algorithm that takesas input, 1^(λ)(λε natural number), N ε natural number, and the value ofthe parameter param_(G):=(q, G, G_(T), g, e) of bilinear pairing groups,and outputs the value of a parameter param_(v) (q, V, G_(T), A, e) ofdual pairing vector spaces which have a security parameter λ and whichform an N-dimensional space V.

G _(dpvs)  [Formula 119]

A case will be described where dual pairing vector spaces areconstructed from the symmetric bilinear pairing groups described above.Dual pairing vector spaces can be constructed from asymmetric bilinearpairing groups as well. The following description can be easily appliedto a case where dual pairing vector spaces are constructed fromasymmetric bilinear pairing groups.

<3. Concept for Implementing Functional Encryption>

<3-1. Span Program>

FIG. 1 is an explanatory drawing of a matrix M̂.

Let {p₁, . . . , p_(n)} be a set of variables. M̂:=(M, ρ) is a labeledmatrix where the matrix M is a (L rows×r columns) matrix over F_(q), andρ is a label of the column of the matrix M and is related to one ofliterals {p₁, . . . , p_(n),

p₁, . . . ,

p_(n)}. A label ρ_(i) (i=1, . . . , L) of every rows of M is related toone of the literals, namely, ρ: {1, . . . , L}→{p₁, . . . , p_(n),

p₁, . . . ,

p_(n)}.

For every input sequence δε{0, 1}^(n), a submatrix M_(δ) of the matrix Mis defined. The matrix M_(δ) is a submatrix consisting of those rows ofthe matrix M, whose labels ρ are related to a value “1” by the inputsequence δ. Namely, the matrix M_(δ) is a submatrix consisting of therows of the matrix M which are related to p_(i) with which δ_(i)=1 andthe rows of the matrix M which are related to

p_(i) with which δ_(i)=0.

FIG. 2 is an explanatory drawing of the matrix M_(δ). Note that in FIG.2, n=7, L=6, and r=5. That is, the set of variables is {p₁, . . . , p₇},and the matrix M is a (6 rows×5 columns) matrix. In FIG. 2, assume thatthe labels ρ are related such that ρ₁ corresponds to

p₂, ρ₂ to p₁, ρ₃ to p₄, ρ4 to

p₅, ρ₅ to

p₃, and ρ₆ to

p₅.

Assume that in an input sequence δε{0,1}⁷, δ₁=1, δ₂=0, δ₃=1, δ₄=0, δ₅=0,δ₆=1, and δ₇=1. In this case, a submatrix consisting of the rows of thematrix M which are related to literals (p₁, p₃, p₆, p₇,

p₂,

p₄,

p₅) surrounded by broken lines is the matrix M_(δ). That is, thesubmatrix consisting of the 1st row (M₁), 2nd row (M₂), and 4th row (M₄)of the matrix M is the matrix M_(δ).

In other words, when map γ: {1, . . . , L}→{0, 1} is [ρ(j)=p_(i)]

[δ_(i)=1] or [ρ(j)=

p_(i)]

[δ_(i)=0], then γ(j)=1; otherwise γ(j)=0. In this case,M_(δ):=(M_(j))_(γ(j)=1). Note that M_(j) is the j-th row of the matrixM.

That is, in FIG. 2, map γ(j)=1 (j=1, 2, 4), so map γ(j)=0 (j=3, 5, 6).Hence, (M_(j))_(γ(j)=1) is M₁, M₂, and M₄, and the matrix M_(δ).

More specifically, whether or not the j-th row of the matrix M isincluded in the matrix M_(δ) is determined by whether the value of themap γ(j) is “0” or “1”.

The span program M̂ accepts an input sequence δ if and only if 1^(→)εspan<M_(δ)>, and rejects the input sequence δ otherwise. Namely, thespan program M̂accepts an input sequence δ if and only if linearcombination of the rows of the matrix M_(δ) which are obtained from thematrix ̂ by the input sequence δ gives 1^(→). 1^(→) is a row vectorwhich has a value “1” in each element.

For example, in FIG. 2, the span program M̂accepts an input sequence δ ifand only if linear combination of the respective rows of the matrixM_(δ) consisting of the 1st, 2nd, and 4th rows of the matrix M gives1^(→). That is, if there exist α₁, α₂, and α₄ with whichα₁(M₁)+α₂(M₂)+α₄(M₄)=1^(→), the span program M̂accepts an input sequenceδ.

A span program is called monotone if the labels ρ are related to onlypositive literals {p₁, . . . , p_(n)}. A span program is callednon-monotone if the labels ρ are related to the literals {p₁, . . . ,p_(n),

p₁, . . . ,

p_(n)}. Suppose that the span program is non-monotone. An accessstructure (non-monotone access structure) is constituted using thenon-monotone span program. Briefly, an access structure controls accessto encryption, namely, it controls whether a ciphertext is to bedecrypted or not.

Because the span program is not monotone but non-monotone, theapplication of the functional encryption schemes constituted using thespan program widens. This will be described later in detail.

<3-2. Inner-Products of Attribute Vectors and Access Structure>

Map γ(j) described above will be calculated using the inner-products ofattribute vectors. Namely, which row of the matrix M is to be includedin the matrix M_(δ) will be determined using the inner-products of theattribute vectors.

u_(t) (t=1, d and u_(t)⊂{0, 1}*) is a sub-universe and an attribute set.Each U, includes identification information (t) of the sub-universe andn_(t)-dimensional vector (v^(→)). Namely, u_(t) is (t, v^(→)) where tε{1, . . . , d} and v^(→)εF_(q) ^(nt).

Let u_(t):=(t, v^(→)) be a variable p of a span program M̂:=(M, ρ), thatis, p:=(t, v^(→)). Let a span program M̂:=(M, ρ) having a variable(p:=(t, v^(→)), (t′, v′^(→)), . . . ) be an access structure S.

That is, the access structure S:=(M, ρ), and ρ: {1, . . . , L}→{(t,v^(→)), (t′, v′^(→)), . . . ,

(t, v^(→)),

(t′, v′^(→)), . . . }.

Let Γ be an attribute set, that is, Γ:={(t, x^(→) _(t))|x^(→) _(t)εF_(q) ^(nt), 1≦t≦d}.

When Γ is given to the access structure S, map γ: {1, . . . , L}>{0, 1}for the span program M̂:=(M, ρ) is defined as follows. For each integeri=1, . . . , L, set γ(j)=1 if [ρ(i)=(t, v^(→) _(i))]

[(t, x^(→) _(t))]εΓ]

[v^(→) _(i)·x^(→) _(t)=0] or [ρ(i)=

(t, v^(→) _(i))]

[(t, x^(→) _(t)) εΓ]̂[v^(→) _(i)·x^(→) _(t)≠0]. Set γ(j)=0 otherwise.

Namely, the map γ is calculated based on the inner-product of theattribute vectors v^(→) and x^(→). As described above, which row of thematrix M is to be included in the matrix M_(δ) is determined by the mapγ. More specifically, which row of the matrix M is to be included in thematrix M_(δ) is determined by the inner-product of the attribute vectorsv^(→) and x^(→). The access structure S:=(M, ρ) accepts Γ if and only if1^(→)ε span<(M_(i))_(γ(i)=1)>.

<3-3. Secret Sharing Scheme>

A secret sharing scheme for the access structure S:=(M, ρ) will bedescribed.

The secret sharing scheme is letting secret information be shared torender it nonsense shared information. For example, secret information sis let to be shared among 10 lumps to generate 10 pieces of sharedinformation. Each of the 10 pieces of shared information does not haveinformation on the secret information s. Hence, even when certain onepiece of shared information is obtained, no information can be obtainedon the secret information s. On the other hand, if all of the 10 piecesof shared information are obtained, the secret information s can berecovered.

Another secret sharing scheme is also available according to which evenwhen all of the 10 pieces of shared information cannot be obtained, ifone or more, but not all, (for example, 8 pieces) of shared informationcan be obtained, then the secret information s can be recovered. A caselike this where the secret information s can be recovered using 8 out of10 pieces of shared information will be called 8-out-of-10. That is, acase where the secret information s can be recovered using t out of itpieces of shared information will be called t-out-of-n. This t will becalled a threshold.

Also, still another secret sharing scheme is available according towhich when 10 pieces of shared information d₁, . . . , d₁₀ aregenerated, the secret information s can be recovered if 8 pieces ofshared information d₁, . . . , d₈ are given, but cannot if 8 pieces ofshared information d₃, . . . , d₁₀ are given. Namely, there is a secretsharing scheme with which whether or not the secret information s can berecovered is controlled not only by the number of pieces of sharedinformation obtained but also depending on the combination of the sharedinformation.

FIG. 3 is an explanatory drawing of s₀. FIG. 4 is an explanatory drawingof s^(→T).

Let a matrix M be a (L rows×r columns) matrix. Let f^(→) a column vectorindicated in Formula 120.

$\begin{matrix}{{\overset{->}{f}}^{T}:={\left( {f_{1},{\ldots \mspace{14mu} f_{r}}} \right)^{T}\overset{U}{}_{q}^{r}}} & \left\lbrack {{Formula}\mspace{14mu} 120} \right\rbrack\end{matrix}$

Let s₀ indicated in Formula 121 be secret information to be shared.

s ₀:={right arrow over (1)}·{right arrow over (f)} ^(T):=Σ_(k=1) ^(r) f_(k)  [Formula 121]

Let s^(→T) indicated in Formula 122 be the vector of L pieces of sharedinformation of s₀.

{right arrow over (s)} ^(T):=(s ₁ , . . . s _(L))^(T) :=M·{right arrowover (f)} ^(T)  [Formula 122]

Let the shared information s_(i) belong to ρ(i).

If the access structure S:=(M, ρ) accepts Γ, that is, 1^(→)εspan<(M_(i))_(γ(i)=1)> for γ{1, . . . , L}→{0. 1}, then there existconstants {α_(i) εF_(q)|i εI} such that I ⊂{1, . . . , L} |γ(i)−=1}.

This is obvious from the explanation on FIG. 2 in that if there existα₁, α₂, and α₄ with which α₁(M₁)+α₂(M₂)+α₄(M₄)=1^(→), the span program M̂accepts an input sequence δ. Namely, if the span program M̂ accepts aninput sequence δ when there exist α₁, α₂, and α₄ with whichα₁(M₁)+α₂(M₂)+α₄(M₄)=1^(→), then there exist α₁, α₂, and α₄ with whichα₁(M₁)+α₂(M₂)+α₄(M₄)=1^(→).

Note Formula 123.

Σ_(iεI)α_(i) s _(i) :=s ₀  [Formula 123]

Note that the constants {α_(i)} can be computed in time polynomial inthe size of the matrix M.

With the functional encryption scheme according to this and thefollowing embodiments, the access structure is constructed by applyingthe inner-product predicate and the secret sharing scheme to the spanprogram, as described above. Therefore, access control can be designedfreely by designing the matrix M in the span program and the attributeinformation x and the attribute information v (predicate information) inthe inner-product predicate. Namely, access control can be designed witha very high degree of freedom. Designing of the matrix M corresponds todesigning conditions such as the threshold of the secret sharing scheme.

For example, the attribute-based encryption scheme described abovecorresponds to a case, in the access structure in the functionalencryption scheme according to this and the following embodiments, wheredesigning of the inner-product predicate is limited to a certaincondition. That is, when compared to the access structure in thefunctional encryption scheme according to this and the followingembodiments, the access structure in the attribute-based encryptionscheme has a lower degree of freedom in access control design because itlacks the degree of freedom in designing the attribute information x andthe attribute information v (predicate information) in the inner-productpredicate. More specifically, the attribute-based encryption schemecorresponds to a case where attribute information {x^(→) _(t)}_(tε{1), .. . , d} and {v^(→) _(t)}_(tε{1), . . . , d} are limited totwo-dimensional vectors for the equality relation, for example, x^(→)_(t):=(1, x_(t)) and v^(→) _(t):=(v_(t), −1).

The inner-product predicate encryption scheme described abovecorresponds to a case, in the access structure in the functionalencryption scheme according to this and the following embodiments, wheredesigning of the matrix M in the span program is limited to a certaincondition. That is, when compared to the access structure in thefunctional encryption scheme according to this and the followingembodiments, the access structure in the inner-product predicateencryption scheme has a lower degree of freedom in access control designbecause it lacks the degree of freedom in designing the matrix M in thespan program. More specifically, the inner-product predicate encryptionscheme corresponds to a case where the secret sharing scheme is limitedto 1-out-of-1 (or d-out-of-d).

In particular, the access structure in the functional encryption schemeaccording to this and the following embodiments constitutes anon-monotone access structure that uses a non-monotone span program.Thus, the degree of freedom in access control designing improves.

More specifically, since the non-monotone span program includes anegative literal (

p), a negative condition can be set. For example, assume that FirstCompany includes four departments of A, B, C, and D. Assume that accesscontrol is to be performed that only the users belonging to departmentsother than B department of First Company are capable of access (capableof decryption). In this case, if a negative condition cannot be set, acondition that “the user belongs to any one of A, C, and D departmentsof First Company” must be set. On the other hand, if a negativecondition can be set, a condition that “the user is an employee of FirstCompany and belongs to a department other than department B” can be set.Namely, since a negative condition can be set, natural condition settingis possible. Although the number of departments is small in this case,this scheme is very effective in a case where the number of departmentsis large.

<4. Basic Structure of Functional Encryption Scheme>

<4-1. Basic Structure of Unified-Policy Functional Encryption Scheme>

The structure of a unified-policy functional encryption scheme will bebriefly described. Note that unified-policy means that policy isembedded in each of the decryption key and the ciphertext, that is, anaccess structure is embedded in each of the decryption key and theciphertext.

The unified-policy functional scheme consists of four algorithms: Setup,KeyGen, Enc, and Dec.

(Setup)

A Setup algorithm is a randomized algorithm that takes as input asecurity parameter λ, and an attribute format n^(→):=((d^(KP); n_(t)^(KP), u_(t) ^(KP), z_(t) ^(KP) (t=1, . . . , d^(KP))) and (d^(CP);n_(t) ^(CP), u_(t) ^(CP), w_(t) ^(KP), z_(t) ^(CP) (t=1, . . . ,d^(CP)))), and outputs public parameters pk and a master key sk.

(KeyGen)

A KeyGen algorithm is a randomized algorithm that takes as input anaccess structure S^(KP):=(M^(KP), ρ^(KP)), an attribute set Γ^(CP):={(t,X^(→) _(t) ^(CP))|x^(→) _(t) ^(CP) εF_(q) ^(ntCP)\{0^(→},) 1≦t≦d^(CP)},the public parameters pk, and the master key sk, and outputs adecryption key sk_((SKP,ΓCP)).

(Enc)

An Enc algorithm is a randomized algorithm that takes as input a messagem, an attribute set Γ^(KP):={(t, x^(→) _(t) ^(KP))|x^(→) _(t)^(KP)εF_(q) ^(ntKP)\{0 ^(→)}, 1≦t≦d^(KP)}, an access structureS^(CP):=(M^(CP), ρ^(CP)), and the public parameters pk, and outputsencrypted data ct_((ΓKP,SCP)).

(Dec)

A Dec algorithm is an algorithm that takes as input the encrypted datact_((ΓKP,SCP)) encrypted under the attribute set and an access structure(Γ^(KP), S^(CP)), the decryption key sk_((SKP,ΓCP)) for the accessstructure and an attribute set (S^(KP), Γ^(CP)), and the publicparameters pk, and outputs either the message m (plaintext information)or distinguished symbol ⊥.

A unified-policy functional encryption scheme holds m=Dec(pk,sk_((SKP, ΓCP)), ct_((ΓKP, SCP))) with overwhelmingly high probabilityfor all public parameters pk and master keys sk indicated in Formula124, all access structures S^(KP), all attribute sets Γ^(CP), alldecryption keys sk_((SKP, ΓCP)) indicated in Formula 125, all messagesm, all attribute sets Γ^(KP), all access structures S^(CP), and allencrypted data ct_((ΓKP, SCP)) indicated in Formula 126, if the accessstructure S^(KP) accepts the attribute set Γ^(KP) and the accessstructure S^(CP) accepts the attribute set Γ^(CP). Namely, the message mcan be obtained if the Dec algorithm is executed by inputting the publicparameters pk, the decryption keys sk_((SKP, ΓCP)), and the encrypteddata ct_((ΓKP, SCP)).

$\begin{matrix}{\left( {{pk},{sk}} \right)\overset{R}{}{{Setup}\left( {1^{\lambda},\overset{->}{n}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 124} \right\rbrack \\{{sk}_{({^{KP},\Gamma^{CP}})}\overset{R}{}{{KeyGen}\left( {{pk},{sk},^{KP},\Gamma^{CP}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 125} \right\rbrack \\{{ct}_{({\Gamma^{KP},^{CP}})}\overset{R}{}{{Enc}\left( {{pk},m,\Gamma^{KP},^{CP}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 126} \right\rbrack\end{matrix}$

<4-2. Cryptographic Processing System 10>

A cryptographic processing system 10 that executes the algorithms of theunified-policy functional encryption scheme described above will bedescribed.

FIG. 5 is a configuration diagram of the cryptographic processing system10 which executes the unified-policy functional encryption scheme.

The cryptographic processing system 10 is provided with a key generationdevice 100, an encryption device 200, and a decryption device 300.

The key generation device 100 executes the Setup algorithm by taking asinput a security parameter λ and an attribute format n^(→):=d^(KP);n_(t) ^(KP), u_(t) ^(KP), w_(t) ^(KP), z_(t) ^(KP) (t=1, . . . ,d^(KP))) and (d^(CP); n_(t) ^(CP), u_(t) ^(CP), w_(t) ^(CP), z_(t) ^(CP)(t=1, . . . , d^(CP)))), and generates public parameters pk and a masterkey sk. The key generation device 100 publicizes the generated publicparameters pk. The key generation device 100 also executes the KeyGenalgorithm by taking as input an access structure S^(KP), the attributeset Γ^(CP), the public parameters pk, and the master key sk, generates adecryption key sk_((SKP,ΓCP)), and distributes the decryption keysk_((SKP,ΓCP))_(to) the decryption device 300 in secrecy.

The encryption device 200 executes the Enc algorithm by taking as inputa message m, an attribute set Γ^(KP), an access structure S^(CP), andthe public parameters pk, and generates encrypted data ct_((ΓKP,SCP)).The encryption device 200 transmits the generated encrypted datact_((ΓKP,SCP)) to the decryption device 300.

The decryption device 300 executes the Dec algorithm by taking as inputthe public parameters pk, the decryption key sk_((SKP,ΓCP)), and theencrypted data ct_((ΓKP,SCP)), and outputs a message m or distinguishedsymbol ⊥.

<4-3. Unified-Policy Functional Encryption Scheme and CryptographicProcessing System 10 in Detail>

The unified-policy functional encryption scheme, and the function andoperation of the cryptographic processing system 10 which executes theunified-policy functional encryption scheme will be described withreference to FIGS. 6 to 12.

FIG. 6 is a function block diagram showing the function of the keygeneration device 100. FIG. 7 is a function block diagram showing thefunction of the encryption device 200. FIG. 8 is a function blockdiagram showing the function of the decryption device 300.

FIGS. 9 and 10 are flowcharts showing the operation of the keygeneration device 100. Note that FIG. 9 is a flowchart showing theprocess of the Setup algorithm, and that FIG. 10 is a flowchart showingthe process of the KeyGen algorithm. FIG. 11 is a flowchart showing theoperation of the encryption device 200 and the process of the Encalgorithm. FIG. 12 is a flowchart showing the operation of thedecryption device 300 and the process of the Dec algorithm.

Normalization is performed to satisfy x_(t,1) ^(KP):=1 and x_(t,1)^(CP):=1. If x_(t,1) ^(KP) and x_(t,1) ^(CP) are not normalized, theymay be normalized as (1/x_(t,1) ^(KP))·x_(t,1) ^(KP) and (1/x_(t,1)^(CP)) x_(t,1) ^(CP). In this case, assume that x_(t,i) ^(KP)≠0 andx_(t,i) ^(CP)≠0.

The function and operation of the key generation device 100 will bedescribed.

As shown in FIG. 6, the key generation device 100 is provided with amaster key generation part 110, a master key storage part 120, aninformation input part 130 (first information input part), a decryptionkey generation part 140, and a key distribution part 150.

The information input part 130 is provided with a KP information inputpart 131 (first KP information input part) and a CP information inputpart 132 (first CP information input part). The decryption keygeneration part 140 is provided with an f vector generation part 141, ans vector generation part 142, a random number generation part 143, amain decryption key generation part 144, a KP decryption key generationpart 145, and a CP decryption key generation part 146.

The process of the Setup algorithm will be described first withreference to FIG. 9.

(S101: Orthogonal Basis Generation Step)

The master key generation part 110 calculates Formula 127 with theprocessing device to randomly generate param_(n→), bases B₀ and B*₀,bases B_(t) ^(KP) and B*_(t) ^(KP) for each integer t=1, . . . , d^(KP),and bases B_(t) ^(CP) and B*₁ ^(CP) for each integer t=1, . . . , dCP.

$\begin{matrix}{_{op}^{up}\left( {1^{\lambda},{\overset{->}{n}:={{\left( {\left( {{d^{KP};n_{t}^{KP}},u_{t}^{KP},w_{t}^{KP},{z_{t}^{KP}\left( {{t = 1},\ldots \mspace{14mu},d^{KP}} \right)}} \right),\left( {{d^{CP};n_{t}^{CP}},u_{t}^{CP},w_{t}^{CP},{z_{t}^{CP}\left( {{t = 1},\ldots \mspace{14mu},d^{CP}} \right)}} \right)} \right):\mspace{79mu} {param}_{}}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}}},\mspace{79mu} {\psi \overset{U}{}_{q}^{X}},\mspace{79mu} {N_{0}:={2 + u_{0} + 1 + w_{0} + z_{0}}},\mspace{79mu} {N_{t}^{KP}:={{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + {z_{t}^{KP}\mspace{79mu} {for}\mspace{14mu} t}} = 1}},\ldots \mspace{14mu},d^{KP},\mspace{79mu} {N_{t}^{CP}:={{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + {z_{t}^{CP}\mspace{79mu} {for}\mspace{14mu} t}} = 1}},\ldots \mspace{14mu},d^{CP},{{param}_{_{0}}:={\left( {q,_{0},_{T},_{0},e} \right):={_{dpvs}\left( {1^{\lambda},N_{0},{param}_{}} \right)}}},\mspace{79mu} {X_{0}:={\left( \chi_{0,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{0},_{q}} \right)}}},\mspace{79mu} {\left( v_{0,i,j} \right)_{i,j}:={\psi \cdot \left( X_{0}^{T} \right)^{- 1}}},\mspace{79mu} {b_{0,i}:=\left( {\chi_{0,i,1},\ldots \mspace{14mu},\chi_{0,i,N_{0}}} \right)_{_{0}}},\mspace{79mu} {_{0}:=\left( {b_{0,1},\ldots \mspace{14mu},b_{0,N_{0}}} \right)},\mspace{79mu} {b_{0,i}^{*}:=\left( {v_{0,i,1},\ldots \mspace{14mu},v_{0,i,N_{0}}} \right)_{_{0}}},\mspace{79mu} {_{0}^{*}:=\left( {b_{0,i}^{*},\ldots \mspace{14mu},b_{0,N_{0}}^{*}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{param}_{_{t}^{KP}}:={\left( {q,_{t}^{KP},_{T},_{t}^{KP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{KP},{param}_{}} \right)}}},\mspace{79mu} {X_{t}^{KP}:={\left( \chi_{t,i,j}^{KP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{KP},_{q}} \right)}}},\mspace{79mu} {\left( v_{t,i,j}^{KP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{KP} \right)^{T} \right)^{- 1}}},\mspace{79mu} {b_{t,i}^{KP}:=\left( {\chi_{t,i,1}^{KP},\ldots \mspace{14mu},\chi_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},\mspace{79mu} {_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,N_{t}^{KP}}^{KP}} \right)},\mspace{79mu} {b_{t,i}^{*{KP}}:=\left( {v_{t,i,1}^{KP},\ldots \mspace{14mu},v_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},\mspace{79mu} {_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,N_{t}^{KP}}^{*{KP}}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{param}_{_{t}^{CP}}:={\left( {q,_{t}^{CP},_{T},_{t}^{CP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{CP},{param}_{}} \right)}}},\mspace{79mu} {X_{t}^{CP}:={\left( \chi_{t,i,j}^{CP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{CP},_{q}} \right)}}},\mspace{79mu} {\left( v_{t,i,j}^{CP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{CP} \right)^{T} \right)^{- 1}}},\mspace{79mu} {b_{t,i}^{CP}:=\left( {\chi_{t,i,1}^{CP},\ldots \mspace{14mu},\chi_{t,i,N_{t}^{CP}}^{CP}} \right)_{_{t}^{CP}}},\mspace{79mu} {_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,N_{t}^{CP}}^{CP}} \right)},\mspace{79mu} {b_{t,i}^{*{CP}}:=\left( {v_{t,i,1}^{CP},\ldots \mspace{14mu},v_{t,i,N_{t}^{CP}}^{CP}} \right)_{_{t}^{CP}}},\mspace{79mu} {_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,N_{t}^{CP}}^{*{CP}}} \right)},\mspace{79mu} {g_{T}:={e\left( {g,g} \right)}^{\psi}},{{param}_{\overset{->}{n}}:={\left( {{param}_{_{0}},\left\{ {param}_{_{t}^{KP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {param}_{_{t}^{CP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}},g_{T}} \right){return}\mspace{14mu} {\left( {{param}_{\overset{->}{n}},\left\{ {_{0},_{0}^{*}} \right\},\left\{ {_{t}^{KP},_{t}^{*{KP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {_{t}^{CP},_{t}^{*{CP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right).}}}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 127} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 executes the followingprocesses.

First, with the input device, the master key generation part 110 takesas input the security parameter λ(1^(λ)) and the attribute formatn^(→):=d^(KP); n_(t) ^(KP), u_(t) ^(KP), w_(t) ^(KP), z_(t) ^(KP) (t=1,. . . , d^(KP))) and (d^(CP); n_(t) ^(CP), u_(t) ^(CP), w_(t) ^(CP),z_(t) ^(CP) (t=1, . . . , d^(CP)))), where d^(KP) is an integer of 1 ormore, and n_(t) ^(KP), u_(t) ^(KP), w_(t) ^(KP), and z_(t) ^(KP) areeach an integer of 1 or more for each integer t=1, . . . , d^(KP); andis an integer of 1 or more, and n_(t) ^(CP), u_(t) ^(CP), w_(t) ^(CP),and z_(t) ^(CP) are each an integer of 1 or more for each integer t=1, .. . , d^(CP).

Then, with the processing device, the master key generation part 110calculates Formula 128.

$\begin{matrix}{{param}_{}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}} & \left\lbrack {{Formula}\mspace{14mu} 128} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 executes algorithm G_(bpg) bytaking as input the security parameter λ(1^(λ)), and generates the valueof a parameter param_(G):=(q, G, G_(T), g, e) of the bilinear pairinggroup.

Then, with the processing device, the master key generation part 110calculates formula 129.

$\begin{matrix}{{{\psi \overset{U}{}_{q}^{X}},{N_{0}:={2 + u_{0} + 1 + w_{0} + z_{0}}},{N_{t}^{KP}:={n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + z_{t}^{KP}}}}{{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{N_{t}^{CP}:={n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + z_{t}^{CP}}}}{{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP}}} & \left\lbrack {{Formula}\mspace{14mu} 129} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 generates a random number ψ.Also, the master key generation part 110 sets 2+u₀+1+w₀+z₀ in N₀, n_(t)^(KP)+u_(t) ^(KP)+w_(t) ^(KP)+z_(t) ^(KP) in N_(t) ^(KP) for eachinteger t=1, . . . , d^(KP), and n_(t) ^(CP)+u_(t) ^(CP)+w_(t)^(CP)+z_(t) ^(CP) for each integer t=1, . . . , d^(CP), where u₀, w₀,and z₀ are each an integer of 1 or more.

Then, with the processing device, the master key generation part 110calculates Formula 130.

$\begin{matrix}{{{param}_{_{0}}:={\left( {q,_{0},_{T},_{0},e} \right):={_{dpvs}\left( {1^{\lambda},N_{0},{param}_{}} \right)}}},\mspace{79mu} {X_{0}:={\left( \chi_{0,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{0},_{q}} \right)}}},\mspace{79mu} {\left( v_{0,i,j} \right)_{i,j}:={\psi \cdot \left( X_{0}^{T} \right)^{- 1}}},\mspace{79mu} {b_{0,i}:=\left( {\chi_{0,i,1},\ldots \mspace{14mu},\chi_{0,i,N_{0}}} \right)_{_{0}}},\mspace{79mu} {_{0}:=\left( {b_{0,1},\ldots \mspace{14mu},b_{0},N_{0}} \right)},\mspace{79mu} {b_{0,i}^{*}:=\left( {v_{0,i,1},\ldots \mspace{14mu},v_{0,i,N_{0}}} \right)_{_{0}}},\mspace{79mu} {_{0}^{*}:=\left( {b_{0,i}^{*},\ldots \mspace{14mu},b_{0,N_{0}}^{*}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 130} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 executes algorithm G_(dpvs)by taking as input the security parameter λ(1^(λ)) which is inputted, N₀which is set, and the value of param_(G):=(q, G, G_(T), g, e) which isgenerated, and generates the value of parameter param_(V0):=(q, V₀,G_(T), A₀, e) of the dual pairing vector spaces.

Also, the master key generation part 110 takes as input N₀ which is set,and F_(q), and generates linear transformation X₀:=(x_(0,i,j))_(i,j)randomly. Note that GL stands for General Linear. Namely, GL is ageneral linear group, a set of square matrices in which the determinantis not 0, and a group with respect to multiplication. Note that(x_(0,i,j))_(i,j) signifies a matrix concerning the suffixes i and j ofthe matrix x_(0,i,j) where i, j=1, . . . , N₀.

Also, based on the random number ψ and linear transformation x₀, themaster key generation part 110 generates (v_(0,i,j))_(i,j):=ψ·(x₀^(T))⁻¹. As (x_(0,i,j))_(i,j) does, (v_(0,i,j))_(i,j) signifies a matrixconcerning the suffices i and j of the matrix v_(0,i,j) where i, j=1, .. . , N₀.

Then, based on the linear transformation x₀, the master key generationpart 110 generates the basis B₀ from the canonical basis A₀. Likewise,based on (v_(0,i,j))_(i,j), the master key generation part 110 generatesthe basis B*₀ from the canonical basis A₀.

Then, with the processing device, the master key generation part 110calculates Formula 131.

$\begin{matrix}{\mspace{79mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{param}_{_{t}^{KP}}:={\left( {q,_{t}^{KP},_{T},_{t}^{KP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{KP},{param}_{}} \right)}}},\mspace{79mu} {X_{t}^{KP}:={\left( \chi_{t,i,j}^{KP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{KP},_{q}} \right)}}},\mspace{79mu} {\left( v_{t,i,j}^{KP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{KP} \right)^{T} \right)^{- 1}}},\mspace{79mu} {b_{t,i}^{KP}:=\left( {\chi_{t,i,1}^{KP},\ldots \mspace{14mu},\chi_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},\mspace{79mu} {_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,N_{t}^{KP}}^{KP}} \right)},\mspace{79mu} {b_{t,i}^{*{KP}}:=\left( {v_{t,i,1}^{KP},\ldots \mspace{14mu},v_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},\mspace{79mu} {_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,N_{t}^{KP}}^{*{KP}}} \right)}}} & \left\lbrack {{Formula}\mspace{14mu} 131} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 executes the followingprocesses for each integer t=1, . . . , d^(KP).

The master key generation part 110 executes algorithm G_(dpvs) by takingas input the security parameter λ(1^(λ)) which is inputted, N_(t) ^(KP)which is set, and the value of param_(G):=(q, G, G_(T), g, e) which isgenerated, and generates the value of parameter param_(VtKP):=(q, G_(T),A_(t) ^(KP), e) of the dual pairing vector spaces.

Also, the master key generation part 110 takes as input N_(t) ^(KP)which is set, and F_(q), and generates linear transformation x_(t)^(KP):=(x_(t) ^(KP) _(i,j))_(i,j) randomly. Note that (x_(t) ^(KP)_(,i,j))_(i,j) randomly. Note that (x_(t) ^(KP) _(,i,j))_(i,j) signifiesa matrix concerning the suffixes i and j of the matrix x_(t) ^(KP)_(,i,j) where i, j=1, . . . , N_(t) ^(KP).

Also, based on the random number w and linear transformation x_(t)^(KP), the master key generation part 110 generates (v_(t) ^(KP)_(,i,j))_(i,j):=ψ((x_(t) ^(KP))^(T))−1. As (x_(t) ^(KP) _(,i,j))_(i,j)does, (v_(t) ^(KP) _(,i,j))_(i,j) signifies a matrix concerning thesuffixes i and j of the matrix v_(t) ^(KP) _(,i,j) where i, j=1, N_(t)^(KP).

Then, based on the linear transformation x_(t) ^(KP), the master keygeneration part 110 generates the basis B_(t) ^(KP) from the canonicalbasis A_(t) ^(KP). Likewise, based on (v_(t) ^(KP) _(,i,j))_(i,j), themaster key generation part 110 generates the basis B*_(t) ^(KP) from thecanonical basis A_(t) ^(KP).

Then, with the processing device, the master key generation part 110calculates Formula 132.

$\begin{matrix}{\mspace{79mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{param}_{_{t}^{CP}}:={\left( {q,_{t}^{CP},_{T},_{t}^{CP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{CP},{param}_{}} \right)}}},\mspace{79mu} {X_{t}^{CP}:={\left( \chi_{t,i,j}^{CP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{CP},_{q}} \right)}}},\mspace{79mu} {\left( v_{t,i,j}^{CP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{CP} \right)^{T} \right)^{- 1}}},\mspace{79mu} {b_{t,i}^{CP}:=\left( {\chi_{t,i,1}^{CP},\ldots \mspace{14mu},\chi_{t,i,N_{t}^{CP}}^{CP}} \right)_{_{t}^{CP}}},\mspace{79mu} {_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,N_{t}^{CP}}^{CP}} \right)},\mspace{79mu} {b_{t,i}^{*{CP}}:=\left( {v_{t,i,1}^{CP},\ldots \mspace{14mu},v_{t,i,N_{t}^{CP}}^{CP}} \right)_{_{t}^{CP}}},\mspace{79mu} {_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,N_{t}^{CP}}^{*{CP}}} \right)}}} & \left\lbrack {{Formula}\mspace{14mu} 132} \right\rbrack\end{matrix}$

Namely, the master key generation part 110 executes the followingprocesses for each integer t=1, . . . , d^(CP).

The master key generation part 110 executes algorithm G_(dpvs) by takingas input the security parameter λ(1^(λ)) which is inputted, N_(t) ^(CP)which is set; and the value of param_(G):=(q, G, G_(T), g, e) which isgenerated, and generates the value of parameter param_(vtCP)(q, v_(t)^(CP), G_(T), A_(t) ^(CP), e) of the dual pairing vector spaces.

Also, the master key generation part 110 takes as input N_(t) ^(CP)which is set, and F_(q), and generates linear transformation x_(t)^(CP):=(x_(t) ^(CP) _(,i,j))_(i,j) randomly. Note that (x_(t) ^(CP)_(,i,j))_(i,j) signifies a matrix concerning the suffixes i and j of thematrix x_(t) ^(CP) _(,i,j) where i, j=1, . . . , N_(t) ^(CP).

Also, based on the random number ψ and linear transformation x_(t)^(CP), the master key generation part 110 generates (v_(t) ^(CP)_(,i,j))_(i,j):=ψ·((x_(t) ^(CP))^(T))⁻¹. As (x_(t) ^(CP) _(,i,j))_(i,j)does, (v_(t) ^(CP) _(,i,j))_(i,j) signifies a matrix concerning thesuffixes i and j of the matrix v_(t) ^(CP) _(,i,j) where i, j=1, . . . ,N_(t) ^(CP).

Then, based on the linear transformation x_(t) ^(CP), the master keygeneration part 110 generates the basis B_(t) ^(CP) from the canonicalbasis A_(t) ^(CP). Likewise, based on (v_(t) ^(CP) _(,i,j))_(i,j), themaster key generation part 110 generates the basis B*_(t) ^(CP) from thecanonical basis A_(t) ^(CP).

Then, with the processing device, the master key generation part 110calculates Formula 133.

g _(T) :=e(g,g)ψ,

param_({right arrow over (n)}):=

  [Formula 133]

Namely, the master key generation part 110 sets e(g, g)^(ψ) in g_(T).

The master key generation part 110 also sets param_(V0), param_(VtKP)for each integer t=1, . . . , d^(KP), paramV_(tCP) for each integer t=1,. . . , d^(CP), and g_(T), in param_(n→). Note that g_(T)=e(b_(0,i),b*_(0,i)) for each integer i=1, . . . , N₀. Note that g_(T)=e(b_(t,i),b*_(t,1)) for each integer t=1, . . . , d^(KP) and each integer i=1, . .. , N_(t) ^(KP). Also, note that g_(T)=e(b_(t,i), b*_(t,i)) for eachinteger t=1, . . . , d^(CP) and each integer i=1, . . . , N_(t) ^(CP).

Then, the master key generation part 110 obtains param_(n→), {B₀, B*₀},{B_(t) ^(KP), B*_(t) ^(KP)} for each integer t=1, . . . , d^(KP), and{B_(t) ^(CP), B*_(t) ^(CP)} for each integer t=1, . . . , d^(CP).

(S102: Public Parameter Generation Step)

With the processing device, the master key generation part 110 generatesa subbasis B̂₀ of the basis B₀, a subbasis B̂_(t) ^(KP) of the basis B_(t)^(KP) for each integer t=1, . . . , d^(KP), and a subbasis B̂_(t) ^(CP)of the basis B_(t) ^(CP) for each integer t=1, . . . , d^(CP), asindicated in Formula 134.

$\begin{matrix}{{{\hat{}}_{0}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,{2 + u_{0} + 1}}^{*},b_{0,{2 + u_{0} + 1 + w_{0} + 1}}^{*},\ldots \mspace{14mu},b_{0,{2 + u_{0} + 1 + w_{0} + z_{0}}}^{*}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{\hat{}}_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{KP},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + 1}}^{KP},\ldots \mspace{14mu},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + z_{t}^{KP}}}^{KP}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{\hat{}}_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{CP},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + 1}}^{CP},\ldots \mspace{14mu},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + z_{t}^{CP}}}^{CP}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 134} \right\rbrack\end{matrix}$

The master key generation part 110 treats the generated subbases B̂₀,B̂_(t) ^(KP), and B̂_(t) ^(CP), the security parameter λ(1^(λ)) inputtedin (S101), and param_(n→) generated in (S101), as the public parameterspk.

(S103: Master Key Generation Step)

With the processing device, the master key generation part 110 generatesa subbasis B̂*₀ of the basis B*₀, a subbasis B̂*_(t) ^(KP) of the basisB*_(t) ^(KP) for each integer t=1, . . . , d^(KP), and a subbasis B̂*_(t)^(CP) of the basis B*_(t) ^(CP) for each integer t=1, . . . , d^(CP), asindicated in Formula 135.

$\begin{matrix}{{{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,{2 + u_{0} + 1}}^{*},b_{0,{2 + u_{0} + 1 + 1}}^{*},\ldots \mspace{14mu},b_{0,{2 + u_{0} + 1 + w_{0}}}^{*}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{\hat{}}_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{*{KP}},b_{t,{n_{t}^{KP} + u_{t}^{KP} + 1}}^{*{KP}},\ldots \mspace{14mu},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP}}}^{KP}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{\hat{}}_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{*{CP}},b_{t,{n_{t}^{CP} + u_{t}^{CP} + 1}}^{*{CP}},\ldots \mspace{14mu},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP}}}^{*{CP}}} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 135} \right\rbrack\end{matrix}$

The master key generation part 110 treats the generated subbases B̂*₀,B̂*₀, B̂_(t) ^(KP), and B̂*_(t) ^(CP), as the master key sk.

(S104: Master Key Storing Step)

The master key storage part 120 stores the public parameters pkgenerated in (S102), in the storage device. The master key storage part120 also stores the master key sk generated in (S103), in the storagedevice.

In brief, from (S101) through (S103), the key generation device 100generates the public parameters pk and the master key sk by executingthe Setup algorithm indicated in Formula 136. Then, in (S104), the keygeneration device 100 stores the generated public parameters pk andmaster key sk, in the storage device.

Note that the public parameters are publicized via, e.g., a network, sothe encryption device 200 and decryption device 300 can acquire them.

$\begin{matrix}{{Setup}\left( {1^{\lambda},{\overset{->}{n}:={\left( {\left( {{d^{KP};n_{t}^{KP}},u_{t}^{KP},w_{t}^{KP},{z_{t}^{KP}\left( {{t = 1},\ldots \mspace{14mu},d^{KP}} \right)}} \right),\left( {{d^{CP};n_{t}^{CP}},u_{t}^{CP},w_{t}^{CP},{z_{t}^{CP}\left( {{t = 1},\ldots \mspace{14mu},d^{CP}} \right)}} \right)} \right):{\left( {{param}_{\overset{->}{n}},_{0},_{0}^{*},\left\{ {_{t}^{KP},_{t}^{*{KP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {_{t}^{CP},_{t}^{*{CP}}} \right\}_{{t = 1},\mspace{11mu} {\ldots \mspace{14mu} d^{CP}}}} \right)\overset{R}{}{_{ob}\left( {1^{\lambda},\overset{->}{n}} \right)}}}},{{\hat{}}_{0}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,{2 + u_{0} + 1}}^{*},b_{0,{2 + u_{0} + 1 + w_{0} + 1}}^{*}, \ldots \mspace{14mu},b_{0,{2 + u_{0} + 1 + w_{0} + z_{0}}}^{*}} \right)},{{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},{b_{0,2}^{*}b_{0,{2 + u_{0} + 1}}^{*}},b_{0,{2 + u_{0} + 1 + 1}}^{*},\ldots \mspace{14mu},b_{0,{2 + u_{0} + 1 + w_{0}}}^{*}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{\hat{}}_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{KP},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + 1}}^{KP},\ldots \mspace{14mu},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + z_{t}^{KP}}}^{KP}} \right)},{{\hat{}}_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{*{KP}},b_{t,{n_{t}^{KP} + u_{t}^{KP} + 1}}^{*{KP}}, \ldots \mspace{14mu},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP}}}^{*{KP}}} \right)},\mspace{79mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{\hat{}}_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{CP},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + 1}}^{CP},\ldots \mspace{14mu},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + z_{t}^{CP}}}^{CP}} \right)},{{\hat{}}_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{*{CP}},b_{t,{n_{t}^{CP} + u_{t}^{CP} + 1}}^{*{CP}}, \ldots \mspace{14mu},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP}}}^{*{CP}}} \right)},{{pk}:=\left( {1^{\lambda},{param}_{\overset{->}{n}},{\hat{}}_{0},\left\{ {\hat{}}_{t}^{KP} \right\}_{{t = 1},\mspace{11mu} {\ldots \mspace{14mu} d^{KP}}},\left\{ {\hat{}}_{t}^{CP} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right)},\mspace{79mu} {{sk}:={\left( {{\hat{}}_{0}^{*},\left\{ {\hat{}}_{t}^{*{KP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {\hat{}}_{t}^{*{CP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right)\mspace{79mu} {return}\mspace{14mu} {pk}}},{{sk}.}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 136} \right\rbrack\end{matrix}$

The process of the KeyGen algorithm will be described with reference toFIG. 10.

(S201: Information Input Step)

With the input device, the first KP information input part 131 takes asinput the access structure S^(KP):=(M^(KP), ρ^(KP)). Note that thematrix M^(KP) is a matrix of L^(KP) rows x r^(KP) columns. L^(KP) andr^(KP) are each an integer of 1 or more.

Also, with the input device, the first CP information input part 132takes as input the attribute set Γ^(CP):={(t, x^(→) _(t) ^(CP):=(x_(t,i)^(CP) (i=1, . . . , n_(t) ^(CP)))εF_(q) ^(ntCP)\{0→})|1≦t≦d^(CP)}. Notethat t need not be all of the integers falling within the range of1≦t≦d^(CP), but may be one or more of integers falling within the rangeof 1≦t≦d^(CP).

The matrix M^(KP) of the access structure S^(KP) is set depending on thecondition of the system the user wishes to realize. Also, for example,the attribute information of the user of the decryption keysk_((SKP,ΓCP)) is set in ρ^(KP) of the access structure S^(KP) and inthe attribute set Γ^(CP).

(S202: f Vector Generation Step)

With the processing device, the f vector generation part 141 generates avector f^(→KP) having r^(KP) pieces of elements, randomly as indicatedin Formula 137.

$\begin{matrix}{{\overset{->}{f}}^{KP}\overset{U}{}_{q}^{r^{KP}}} & \left\lbrack {{Formula}\mspace{14mu} 137} \right\rbrack\end{matrix}$

(S203: s Vector Generation Step)

With the processing device, the s vector generation part 142 generates avector (s^(→KP))^(T), based on the (L^(KP) rows×r^(KP) columns) matrixM^(KP) included in the access structure S^(KP) inputted in (S201) andthe vector f^(→KP) generated in (S202) and having r^(KP) pieces ofelements, as indicated in Formula 138.

({right arrow over (s)} ^(KP))^(T):=(s ₁ ^(KP) , . . . ,s _(L) _(KP)^(KP))^(T) :=M ^(KP)·({right arrow over (f)} ^(KP))^(T)  [Formula 138]

With the processing device, the s vector generation part 142 generates avalue s₀ ^(KP), based on the vector f^(→KP) generated in (S202), asindicated in Formula 139. Note that 1^(→) is a vector which has a value1 in all its elements.

s ₀ ^(KP):={right arrow over (1)}·({right arrow over (f)}^(KP))^(T)  [Formula 139]

(S204: Random Number Generation Step)

With the processing device, the random number generation part 143generates a random number δ^(CP), a random number η^(→) _(t) ^(CP) foreach integer t of (t, x^(→) _(t) ^(CP)) included in Γ^(CP), and a randomnumber η^(→) ₀, as indicated in Formula 140.

$\begin{matrix}{{{\delta^{CP}\overset{U}{}_{q}},{{\overset{->}{\eta}}_{t}^{CP}:={\left( {\eta_{t,1}^{CP},\ldots \mspace{14mu},\eta_{t,w_{t}^{CP}}^{CP}} \right)\overset{U}{}_{q}^{w_{t}^{CP}}}}}{{{{such}\mspace{14mu} {that}\mspace{14mu} \left( {t,{\overset{->}{x}}_{t}^{CP}} \right)} \in \Gamma^{CP}},{{\overset{->}{\eta}}_{0}:={\left( {\eta_{0,1},\ldots \mspace{14mu},\eta_{0,w_{0}}} \right)\overset{U}{}_{q}^{w_{0}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 140} \right\rbrack\end{matrix}$

(S205: Main Decryption Key Generation Step)

With the processing device, the main decryption key generation part 144generates a main decryption key k*₀, which is an element of thedecryption key sk_((SKP,ΓCP)), as indicated in Formula 141.

$\begin{matrix}{k_{0}^{*}:={\left( {{- s_{0}^{KP}},\delta^{CP},{\overset{\overset{u_{0}}{}}{0^{u_{0}},}1},{\overset{\overset{w_{0}}{}}{\eta_{0,1},\ldots \mspace{14mu},\eta_{0,w_{0}},}\overset{\overset{z_{0}}{}}{0^{z_{0}}}}} \right)_{0}^{*}}} & \left\lbrack {{Formula}\mspace{14mu} 141} \right\rbrack\end{matrix}$

As described above, for the bases B and B* indicated in Formula 110,Formula 111 is established. Hence, Formula 141 means that thecoefficient for the basis vector of a basis B*₀ is set as describedbelow. For the purpose of simple representation, a basis vector b*_(0,i)is specified only by its i portion. For example, a basis vector 1signifies a basis vector b*_(0,1). Basis vectors 1, . . . , 3 signifybasis vectors b*_(0,1), . . . , b*_(0,3), respectively.

−s₀ ^(KP) is set as the coefficient for the basis vector 1 of the basisB*₀. The random number δ^(CP) is set as the coefficient for the basisvector 2. 0 is set as the coefficient for basis vectors 2+1, . . . ,2+u₀. 1 is set as the coefficient for a basis vector 2+u₀+1. Randomnumbers η_(0,1), . . . , η₀, . . . , η_(0,w0) (where w0 represents w₀)are each set as the coefficient for basis vectors 2+u₀+1+1, . . . ,2+u₀+1+w₀. 0 is set as the coefficient for basis vectors 2+u₀+1+w₀+1, .. . , 2+u₀+1+w₀+z₀.

(S206: KP Decryption Key Generation Step)

With the processing device, the KP decryption key generation part 145generates a KP decryption key k*_(i) ^(KP), which is an element of thedecryption key sk_((SKP,ΓCP)), for each integer i=1, . . . , L^(KP), asindicated in Formula 142.

$\begin{matrix}{\mspace{79mu} {{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{KP},{{{if}\mspace{14mu} {\rho^{KP}(i)}} = \left( {t,{{\overset{->}{v}}_{i}^{KP}:={\left( {v_{i,1}^{KP},\ldots \mspace{14mu},v_{i,n_{t}^{KP}}^{KP}} \right) \in {_{q}^{n_{t}^{KP}}\backslash \left\{ \overset{\rightharpoonup}{0} \right\}}}}} \right)},\mspace{79mu} {\theta_{i}^{KP}\overset{U}{}_{q}},{{\overset{->}{\eta}}_{i}^{KP}:={\left( {\eta_{i,1}^{KP},\ldots \mspace{14mu},\eta_{i,w_{t}^{KP}}^{KP}} \right)\overset{U}{}_{q}^{w_{t}^{KP}}}},\mspace{79mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{{s_{i}^{KP}{\overset{->}{e}}_{t,1}^{KP}} + {\theta_{i}^{KP}{\overset{->}{v}}_{i}^{KP}}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{KP}}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{KP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{KP}} \right)}},\mspace{79mu} {{\overset{->}{\eta}}_{i}^{KP}:={\left( {\eta_{i,1}^{KP},\ldots \mspace{14mu},\eta_{i,w_{t}^{KP}}^{KP}} \right)\overset{U}{}_{q}^{w_{t}^{KP}}}},\mspace{76mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{s_{i}^{KP}{\overset{->}{v}}_{i}^{KP}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{KP}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 142} \right\rbrack\end{matrix}$

More specifically, as Formula 141 does, Formula 142 means that thecoefficient for the basis vector of a basis B*_(t) ^(KP) is set asdescribed below. For the purpose of simple representation, a basisvector b*_(t,i) ^(KP) is specified only by its i portion. For example, abasis vector 1 signifies a basis vector b*_(t,1) ^(KP). Basis vectors 1,. . . , 3 signify basis vectors b*_(t,1) ^(KP), b*_(t,3) ^(KP),respectively.

When ρ^(KP)(i) is a positive tuple (t, v^(→) _(i) ^(KP)), s_(i)^(KP)+θ_(i) ^(KP)v_(i,1) ^(KP) is set as the coefficient for the basisvector 1. As described above, e^(→) _(t,j) ^(KP) represents a regularbasis vector indicated in Formula 112. Also, θ_(i) ^(KP)v_(i,2) ^(KP), .. . , θ_(i) ^(KP)v_(i,ntKP) ^(KP) (where ntKP represents n_(t) ^(KP))are each set as the coefficient for basis vectors 2, . . . , n_(t)^(KP). 0 is set as the coefficient for basis vectors n_(t) ^(KP)+1, . .. , n_(t) ^(KP)+u_(t) ^(KP). η_(i,1) ^(KP), . . . , η_(wtKP) ^(KP)(where wtKP represents w_(t) ^(KP)) are each set as the coefficient forbasis vectors n_(t) ^(KP)+u_(t) ^(KP)+1, . . . , n_(t) ^(KP)+u_(t)^(KP)+w_(t) ^(KP). 0 is set as the coefficient for basis vectors n_(t)^(KP)+u_(t) ^(KP)+w_(t) ^(KP) +1, . . . , n _(t) ^(KP), u_(t) ^(KP),w_(t) ^(KP), and z_(t) ^(KP).

When ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP), s_(i) ^(KP)v_(i,1) ^(KP), . . . , s_(i)^(KP)v_(i,ntKP) ^(KP) (where ntKP represents n_(t) ^(KP)) are each setas the coefficient for the basis vectors 1, . . . , n_(t) ^(KP). 0 isset as the coefficient for basis vectors n_(t) ^(KP)+1, . . . , n_(t)^(KP)+u_(t) ^(KP). η_(i,1) ^(KP), . . . , η_(i,wtKP) ^(KP) (where wtKPrepresents w_(t) ^(KP)) are each set as the coefficient for basisvectors n_(t) ^(KP)+u_(t) ^(KP)+1, . . . , n_(t) ^(KP)+u_(t) ^(KP)+w_(t)^(KP). 0 is set as the coefficient for basis vectors n_(t) ^(KP)+u_(t)^(KP)+w_(t) ^(KP)+1, . . . , n_(t) ^(KP)+u_(t) ^(KP)+w_(t) ^(KP)+z_(t)^(KP).

Note that θ_(i) ^(KP) and η^(→) _(i) ^(KP) are random numbers generatedby the random number generation part 143.

(S207: CP Decryption Key Generation Step)

With the processing device, the CP decryption key generation part 146generates a CP decryption key k*_(t) ^(CP), which is an element of thedecryption key sk_((SKP,ΓCP)), for each integer t of (t, x^(→) _(t)^(CP)) included in Γ^(CP), as indicated in Formula 143.

$\begin{matrix}{{k_{t}^{*{CP}}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{\delta^{CP}{\overset{->}{x}}_{t}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{{\overset{->}{\eta}}_{t}^{CP},}\overset{\overset{z_{t}^{CP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{CP}}}}{{{for}\left( {t,{\overset{->}{x}}_{t}^{CP}} \right)} \in \Gamma^{CP}}} & \left\lbrack {{Formula}\mspace{14mu} 143} \right\rbrack\end{matrix}$

More specifically, as Formula 141 does, Formula 143 means that thecoefficient for the basis vector of a basis B*_(t) ^(CP) is set asdescribed below. For the purpose of simple representation, a basisvector b*_(t,i) ^(CP) is specified only by its i portion. For example, abasis vector 1 signifies a basis vector b*_(t,1) ^(CP). Basis vectors 1,. . . , 3 signify basis vectors b*_(t,1) ^(CP), b*_(t,3) ^(CP),respectively.

Also, δ^(CP)x_(t,1) ^(CP), . . . , δ^(CP)x_(t,ntCP) ^(CP) (where ntCPrepresents n_(t) ^(CP)) are each set as the coefficient for the basisvectors 1, . . . , n_(t) ^(CP). 0 is set as the coefficient for basisvectors n_(t) ^(CP)+1, . . . , n_(t) ^(CP)+u_(t) ^(CP). η_(t,1) ^(CP), .. . , η_(t,wtCP) ^(CP) (where wtCP represents w_(t) ^(CP)) are each setas the coefficient for basis vectors n_(t) ^(CP)+u_(t) ^(CP)+1, . . . ,n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP). 0 is set as the coefficient forbasis vectors n_(t) ^(CP)+u_(t) ^(CP)+1, . . . , n_(t) ^(CP)+u_(t)^(CP)+w_(t) ^(CP)+z_(t) ^(CP).

(S208: Key Distribution Step)

For example, with the communication device, the key distribution part150 distributes the decryption key sk_((SKP,ΓCP)), constituted aselements by the main decryption key k*₀, the access structure S^(KP) andthe KP decryption key k*_(i) ^(KP) (i=1, . . . , L^(KP)), and theattribute set Γ^(CP) and the CP decryption key k*_(t) ^(CP) (t is t of(t, x^(→) _(t) ^(CP)) included in the attribute set Γ^(CP)), to thedecryption device 300 in secrecy via the network. As a matter of course,the decryption key sk_((SKP,ΓCP)) may be distributed to the decryptiondevice 300 by another method.

More specifically, from (S201) through (S207), the key generation device100 generates the decryption key sk_((SKP,ΓCP)) by executing the KeyGenalgorithm indicated in Formula 144. Then, in (S208), the key generationdevice 100 distributes the generated decryption key sk_((SKP,ΓCP)) tothe decryption device 300.

                                    [Formula  144]${KeyGen}\left( {{pk},{sk},{^{KP}:=\left( {M^{KP},\rho^{KP}} \right)},{\Gamma^{CP}:=\left\{ {{\left( {t,{{\overset{->}{x}}_{t}^{CP}:={\left( {x_{t,1}^{CP},\ldots \mspace{14mu},x_{t,n_{t}^{CP}}^{CP}} \right) \in {_{q}^{n_{t}^{CP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right){1 \leq t \leq d^{CP}}},{x_{t,1}^{CP}:=1}} \right\}}} \right)$$\mspace{79mu} {{{\overset{->}{f}}^{KP}\overset{U}{}_{q}^{r^{KP}}},{\left( {\overset{->}{s}}^{KP} \right)^{T}:={\left( {s_{1}^{KP},\ldots \mspace{14mu},s_{L^{KP}}^{KP}} \right)^{T}:={M^{KP} \cdot \left( {\overset{->}{f}}^{KP} \right)^{T}}}},\mspace{79mu} {s_{0}^{KP}:={\overset{->}{1} \cdot \left( {\overset{->}{f}}^{KP} \right)^{T}}},\mspace{79mu} {\delta^{CP}\overset{U}{}_{q}},{{{{\overset{->}{\eta}}_{t}^{CP}\overset{U}{}_{q}^{w_{t}^{CP}}}\mspace{14mu} {such}\mspace{14mu} {{that}\left( {t,{\overset{->}{x}}_{t}^{CP}} \right)}} \in \Gamma^{CP}},\mspace{79mu} {{\overset{->}{\eta}}_{0}\overset{U}{}_{q}^{w_{0}}},\mspace{79mu} {k_{0}^{*}:=\left( {{- s_{0}^{KP}},\delta^{CP},{\overset{\overset{u_{0}}{}}{0^{u_{0}},}1},{\overset{\overset{w_{0}}{}}{\eta_{0,1},\ldots \mspace{14mu},\eta_{0,w_{0}},}\overset{\overset{z_{0}}{}}{0^{z_{0}}}}} \right)_{_{0}^{*}}},\mspace{79mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{KP},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{KP}(i)}} = \left( {t,{{\overset{->}{v}}_{i}^{KP}:={\left( {v_{i,1}^{KP},\ldots \mspace{14mu},v_{i,n_{t}^{KP}}^{KP}} \right) \in {_{q}^{n_{t}^{KP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right)},\mspace{79mu} {\theta_{i}^{KP}\overset{U}{}_{q}},{{\overset{->}{\eta}}_{i}^{KP}\overset{U}{}_{q}^{w_{t}^{KP}}},\mspace{79mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{{s_{i}^{KP}{\overset{->}{e}}_{t,1}^{KP}} + {\theta_{i}^{KP}{\overset{->}{v}}_{i}^{KP}}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{KP}}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{KP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{KP}} \right)}},{{\overset{->}{\eta}}_{i}^{KP}\overset{U}{}_{q}^{w_{t}^{KP}}},\mspace{79mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{s_{i}^{KP}{\overset{->}{v}}_{i}^{KP}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{KP}}}},\mspace{79mu} {for}}$$\mspace{79mu} {{\left( {t,{\overset{->}{x}}_{t}^{CP}} \right) \in \Gamma^{CP}},\mspace{79mu} {k_{t}^{*{CP}}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{\delta^{CP}{\overset{->}{x}}_{t}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{{\overset{->}{\eta}}_{t}^{CP},}\overset{\overset{z_{t}^{CP}}{}}{0^{z_{t}^{KP}}}} \right)_{_{t}^{*{CP}}}},{{{return}\mspace{14mu} {sk}_{({^{KP},\Gamma^{CP}})}}:={\left( {{k_{o}^{*};^{KP}},k_{1}^{*{KP}},\ldots \mspace{14mu},{k_{\mathcal{L}^{KP}}^{*{KP}};\Gamma^{CP}},\left\{ k_{t}^{*{CP}} \right\}_{{({t,{\overset{->}{x}}_{t}^{CP}})} \in \Gamma^{CP}}} \right).}}}$

The function and operation of the encryption device 200 will bedescribed.

As shown in FIG. 7, the encryption device 200 is provided with a publicparameter acquisition part 210, an information input part 220 (secondinformation input part), an encrypted data generation part 230, and adata transmission part 240 (data output part).

The information input part 220 is provided with a KP information inputpart 221 (second KP information input part), a CP information input part222 (second CP information input part), and a message input part 223.The encrypted data generation part 230 is provided with an f vectorgeneration part 231, an s vector generation part 232, a random numbergeneration part 233, a main encrypted data generation part 234, a KPencrypted data generation part 235, a CP encrypted data generation part236, and a message encrypted data generation part 237.

The process of the Enc algorithm will be described with reference toFIG. 11.

(S301: Public Parameter Acquisition Step)

For example, with the communication device, the public parameteracquisition part 210 acquires the public parameters pk generated by thekey generation device 100, via the network.

(S302: Information Input Step)

With the input device, the KP information input part 221 takes as inputthe attribute set Γ^(KP):={(t, x^(→) _(t) ^(KP):=(x_(t,i) ^(KP) (i=1 . .. , n_(t) ^(KP)))εF_(qnt) ^(KP)\{0^(→)})|1≦t≦d^(KP)}. Note that t neednot be all of the integers t falling within the range of 1≦t≦d^(KP), butmay be one or more of integers t falling within the range of 1≦t≦d^(KP).

Also, with the input device, the CP information input part 222 takes asinput the access structure S^(CP):=(M^(CP), ρ^(CP)). Note that thematrix M^(CP) is a matrix of L^(CP) rows×r^(CP) columns where L^(CP) andr^(CP) are each an integer of 1 or more.

Also, with the input device, the message input part takes as input themessage m to be transmitted to the decryption device 300.

The matrix M^(CP) of the access structure S^(CP) is set in accordancewith the condition of the system the user wishes to realize. Forexample, attribute information of a decryptable user is set in ρ^(CP) ofthe access structure S^(CP) and the attribute set Γ^(KP).

(S303: Random Number Generation Step)

With the processing device, the random number generation part 233generates a random number ω^(KP), a random number φ^(→) ₀, φ^(→) _(t)^(KP) for each integer t of (t, x^(→) _(t) ^(KP)) included in Γ^(KP),and a random number ζ, as indicated in Formula 145.

$\begin{matrix}{{\omega^{KP},{\zeta \overset{U}{}_{q}},{{\overset{->}{\phi}}_{0}:={\left( {\phi_{0,1},\ldots \mspace{14mu},\phi_{0,z_{0}}} \right)\overset{U}{}_{q}^{z_{0}}}},{{\overset{->}{\phi}}_{t}^{KP}:={\left( {\phi_{t,1}^{KP},\ldots \mspace{14mu},\phi_{t,z_{t}^{KP}}^{KP}} \right)\overset{U}{}_{q}^{z_{t}^{KP}}}}}{{{for}\left( {t,{\overset{->}{x}}_{t}^{KP}} \right)} \in \Gamma}} & \left\lbrack {{Formula}\mspace{14mu} 145} \right\rbrack\end{matrix}$

(S304: f Vector Generation Step)

With the processing device, the f vector generation part 231 generates avector f^(→CP) having r^(CP) pieces of elements, randomly as indicatedin Formula 146.

$\begin{matrix}{{\overset{->}{f}}^{CP}\overset{R}{}_{q}^{r^{CP}}} & \left\lbrack {{Formula}\mspace{14mu} 146} \right\rbrack\end{matrix}$

(S305: s Vector Generation Step)

With the processing device, the s vector generation part 232 generates avector (s^(→CP))^(T), based on the matrix M^(CP) of (L^(CP) rows×r^(CP)columns) included in the access structure S^(CP) inputted in (S302), andthe vector f^(→CP) generated in (S304) and having the r^(CP) pieces ofelements, as indicated in Formula 147.

({right arrow over (s)} ^(CP))^(T):=(s ₁ ^(CP) , . . . ,s _(L) _(CP)^(CP))^(T) :=M ^(CP)·({right arrow over (f)} ^(CP)  [Formula 147]

With the processing device, s vector generation part 142 generates avalue s₀ ^(CP), based on the vector f^(→CP) generated in (S304), asindicated in Formula 148. Note that 1^(→) is a vector which has a value1 in all its elements.

s ₀ ^(CP):={right arrow over (1)}·({right arrow over (f)}^(CP))^(T)  [Formula 148]

(S306: Main Encrypted Data Generation Step)

With the processing device, the main encrypted data generation part 234generates main encrypted data c₀, which is an element of the encrypteddata ct_((ΓKP,SCP)), as indicated in Formula 149.

$\begin{matrix}{c_{0}:=\left( {\omega^{KP},{- s_{0}^{CP}},{\overset{\overset{u_{0}}{}}{0^{u_{0}},}\zeta},{\overset{\overset{w_{0}}{}}{0^{w_{0}},}\overset{\overset{z_{0}}{}}{\phi_{0,1},\ldots \mspace{14mu},\phi_{0,z_{0}}}}} \right)_{_{0}}} & \left\lbrack {{Formula}\mspace{14mu} 149} \right\rbrack\end{matrix}$

As described above, for the bases B and B* indicated in Formula 110,Formula 111 is established. Hence, Formula 149 means that thecoefficient for the basis vector of a basis B₀ is set as describedbelow. For the purpose of simple representation, a basis vector b*_(0,i)is specified only by its i portion. For example, a basis vector 1signifies a basis vector b_(0,1). Basis vectors 1, . . . , 3 signifybasis vectors b_(0,i), . . . , b_(0,3).

A random number ω^(KP) is set as the coefficient for the basis vector 1of the basis B₀. −s₀ ^(CP) is set as the coefficient for the basisvector 2. 0 is set as the coefficient for the basis vectors 2+1, . . . ,2+u₀. A random number ζ is set as the coefficient for a basis vector2+u₀+1. 0 is set as the coefficient for basis vectors 2+u₀+1+1, . . . ,2+u₀+1+w₀. Random numbers φ_(0,1), . . . , φ_(0,z0) (where z0 representsz₀) are each set as the coefficient for basis vectors 2+u₀+1+w₀+1, . . ., 2+u₀+1+w₀+z₀.

(S307: KP Encrypted Data Generation Step)

The KP encrypted data generation part 235 generates KP encrypted datac_(t) ^(CP), which is an element of the encrypted data ct_((ΓKP,SCP)),for each integer t of (t, x^(→) _(t) ^(KP)) included in Γ^(KP), asindicated in Formula 150.

$\begin{matrix}{{c_{t}^{KP}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{\omega^{KP}{\overset{->}{x}}_{t}^{KP}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{0^{w_{t}^{KP}},}\overset{\overset{z_{t}^{KP}}{}}{{\overset{->}{\phi}}_{t}^{KP}}} \right)_{_{t}^{KP}}}{{{for}\left( {t,{\overset{->}{x}}_{t}^{KP}} \right)} \in \Gamma^{KP}}} & \left\lbrack {{Formula}\mspace{14mu} 150} \right\rbrack\end{matrix}$

More specifically, as Formula 149 does, Formula 150 means that thecoefficient for the basis vector of a basis B_(t) ^(KP) is set asdescribed below. For the purpose of simple representation, a basisvector b_(t,i) ^(KP) is specified only by its i portion. For example, abasis vector 1 signifies a basis vector b_(t,1) ^(KP). Basis vectors 1,. . . , 3 signify basis vectors b_(t,1) ^(KP), . . . , b_(t,3) ^(KP),respectively.

ω^(KP)x_(t,1) ^(KP), . . . , ω^(KP)x_(t,ntKP) ^(KP) (where ntKPrepresents n_(t) ^(KP)) are each set as the coefficient for the basisvectors 1, . . . , n_(t) ^(KP). 0 is set as the coefficient for basisvectors n_(t) ^(KP)+1, . . . , n_(t) ^(KP)+u_(t) ^(KP)+w_(t) ^(KP).φ_(t,1) ^(KP), . . . , φ_(t,ztKP) ^(KP) (where ztCP represents z_(t)^(CP)) are each set as the coefficient for basis vectors n_(t)^(KP)+u_(t) ^(KP)+w_(t) ^(KP)+1, . . . , n_(t) ^(KP+u) _(t) ^(KP)+w_(t)^(KP)+z_(t) ^(KP).

(S308: CP Encrypted Data Generation Step)

The CP encrypted data generation part 236 generates CP encrypted datac_(i) ^(CP), which is an element of the encrypted data ct_((ΓKP,SCP)),for each integer i=1, . . . , L^(CP), as indicated in Formula 151.

$\begin{matrix}{\mspace{79mu} {{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{CP},{{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,{{\overset{->}{v}}_{i}^{CP}:={\left( {v_{i,1}^{CP},\ldots \mspace{14mu},v_{i,n_{t}^{CP}}^{CP}} \right) \in {_{q}^{n_{t}^{CP}}\backslash \left\{ \overset{\rightharpoonup}{0} \right\}}}}} \right)\left( {v_{i,n_{t}^{CP}}^{CP}:=1} \right)}},\mspace{79mu} {\theta_{i}^{CP}\overset{U}{}_{q}},{{\overset{->}{\phi}}_{i}^{CP}:={\left( {\phi_{i,1}^{CP},\ldots \mspace{14mu},\phi_{i,z_{t}^{CP}}^{CP}} \right)\overset{U}{}_{q}^{z_{t}^{CP}}}},\mspace{79mu} {c_{i}^{*{CP}}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{{s_{i}^{CP}{\overset{->}{e}}_{t,1}^{CP}} + {\theta_{i}^{CP}{\overset{->}{v}}_{i}^{CP}}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{0^{w_{t}^{CP}},}\overset{\overset{z_{t}^{CP}}{}}{{\overset{->}{\phi}}_{i}^{CP}}} \right)_{_{t}^{*{CP}}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{CP}} \right)}},\mspace{79mu} {{\overset{->}{\phi}}_{i}^{CP}:={\left( {\phi_{i,0}^{CP},\ldots \mspace{14mu},\phi_{i,z_{t}^{CP}}^{CP}} \right)\overset{U}{}_{q}^{z_{t}^{CP}}}},\mspace{79mu} {c_{i}^{CP}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{s_{i}^{CP}{\overset{->}{v}}_{i}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{0^{w_{t}^{CP}},}\overset{\overset{z_{t}^{CP}}{}}{{\overset{->}{\phi}}_{t}^{CP}}} \right)_{_{t}^{CP}}}}} & \left\lbrack {{Formula}\mspace{14mu} 151} \right\rbrack\end{matrix}$

More specifically, as Formula 150 does, Formula 151 means that thecoefficient for the basis vector of a basis B_(t) ^(CP) is set asdescribed below. For the purpose of simple representation, a basisvector b_(t,i) ^(CP) is specified only by its i portion. For example, abasis vector 1 signifies a basis vector b_(t,i) ^(CP). Basis vectors 1,. . . , 3 signify basis vectors b_(t,1) ^(CP), . . . , b_(1,3) ^(CP),respectively.

When ρ^(CP)(i) is a positive tuple (t, v^(→) _(i) ^(CP)), s_(i)^(CP)+θ_(i) ^(CP)v_(i,1) ^(CP) is set as the coefficient for the basisvector 1. As described above, e^(→) _(t,j) ^(CP) represents a regularbasis vector indicated in Formula 112. Also, θ_(i) ^(CP)v_(i,2) ^(CP), .. . , θ_(i) ^(CP)v_(i,ntCP) ^(CP) (where ntCP represents n_(t) ^(CP))are each set as the coefficient for basis vectors 2, . . . , n_(t)^(CP). 0 is set as the coefficient for basis vectors n_(t) ^(CP)+1, . .. , n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP). φ_(i,1) ^(CP), . . . ,φ_(i,ztCP) ^(CP) (where ztCP represents Z_(t) ^(CP)) are each set as thecoefficient for basis vectors n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+1, . .. , n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+z_(t) ^(CP).

When ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), s_(i) ^(CP)v_(i,1) ^(CP), . . . , s_(i)^(CP)v_(i,ntCP) ^(CP) (where ntCP represents n_(t) ^(CP)) are each setas the coefficient for the basis vectors 1, . . . , n_(t) ^(CP). 0 isset as the coefficient for basis vectors n_(t) ^(CP)+1, . . . , n_(t)^(CP)+u_(t) ^(CP)+w_(t) ^(CP). φ_(i,1) ^(CP), . . . , φ_(i,ztCP) ^(CP),(where ztCP represents z_(t) ^(CP)) are each set as the coefficient forbasis vectors n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+1, . . . , n_(t)^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+z_(t) ^(CP).

Note that θ_(i) ^(CP) and φ_(i) ^(CP) are random numbers generated bythe random number generation part 233.

(S309: Message Encrypted Data Generation Step)

With the processing device, the message encrypted data generation part237 generates message encrypted data c_(d+1), which is an element ofencrypted data ct_((ΓKP,SCP)), as indicated by Formula 152.

c _(d+1) :=g _(T) ^(ζ) m  [Formula 152]

As described above, Formula 153 is established.

g _(T) e(g,g)^(ψ)  [Formula 153]

(S310: Data Transmission Step)

For example, with the communication device, the data transmission part240 transmits the encrypted data ct_((ΓKP,SCP)), constituted as elementsby the main encrypted data c₀, the attribute set Γ_(KP) and KP encrypteddata c_(t) ^(KP), the access structure S^(CP) and CP encrypted datac_(i) ^(CP), and the message encrypted data c_(d+1), to the decryptiondevice 300 via the network. As a matter of course, the encrypted datact_((ΓTK,SCP)) may be transmitted to the decryption device 300 byanother method.

More specifically, from (S301) through (S309), the encryption device 200generates the encrypted data ct_((ΓKP,SCP)) by executing the Encalgorithm indicated in Formula 154. In (S310), the encryption device 200transmits the generated encrypted data ct_((ΓKP,SCP)) to the decryptiondevice 300.

                                    [Formula  154]${{{Enc}\left( {{pk},m,{\Gamma^{KP}:=\left\{ {{\left( {t,{{\overset{->}{x}}_{t}^{KP}:={\left( {x_{t,1}^{KP},\ldots \mspace{14mu},x_{t,n_{t}^{KP}}^{KP}} \right) \in {_{q}^{n_{t}^{KP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right){1 \leq t \leq d^{KP}}},{x_{t,1}^{KP}:=1}} \right\}},{^{CP}:=\left( {M^{CP},\rho^{CP}} \right)}} \right)}:\omega^{KP}},{\zeta \overset{U}{}_{q}},{{\overset{->}{\phi}}_{0}\overset{U}{}_{q}^{z_{0}}},{{\overset{->}{\phi}}_{t}^{KP}\overset{U}{}_{q}^{z_{t}^{KP}}}$$\mspace{79mu} {{{{for}\left( {t,{\overset{->}{x}}_{t}^{KP}} \right)} \in \Gamma},\mspace{79mu} {{\overset{->}{f}}^{CP}\overset{R}{}_{q}^{r^{CP}}},{\left( {\overset{->}{s}}^{CP} \right)^{T}:={\left( {s_{1}^{CP},\ldots \mspace{14mu},s_{L^{CP}}^{CP}} \right)^{T}:={M^{CP} \cdot \left( {\overset{->}{f}}^{CP} \right)^{T}}}},\mspace{79mu} {s_{0}^{CP}:={\overset{->}{1} \cdot \left( {\overset{->}{f}}^{CP} \right)^{T}}},\mspace{79mu} {c_{0}:=\left( {\omega^{KP},{- s_{0}^{CP}},{\overset{\overset{u_{0}}{}}{0^{u_{0}},}\zeta},{\overset{\overset{w_{0}}{}}{0^{w_{0}},}\overset{\overset{z_{0}}{}}{\phi_{0,1},\ldots \mspace{14mu},\phi_{0,z_{0}}}}} \right)_{_{0}}},\mspace{79mu} {for}}$$\mspace{79mu} {{\left( {t,{\overset{->}{x}}_{t}^{KP}} \right) \in \Gamma^{KP}},\mspace{79mu} {c_{t}^{KP}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{\omega^{KP}{\overset{->}{x}}_{t}^{KP}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{0^{w_{t}^{KP}},}\overset{\overset{z_{t}^{KP}}{}}{{\overset{->}{\phi}}_{t}^{KP}}} \right)_{_{t}^{KP}}},\mspace{79mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{CP},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{CP}(i)}} = \left( {t,{{\overset{->}{v}}_{i}^{CP}:={\left( {v_{i,1}^{CP},\ldots \mspace{14mu},v_{i,n_{t}^{CP}}^{CP}} \right) \in {_{q}^{n_{t}^{CP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right)},\mspace{79mu} {\theta_{i}^{CP}\overset{U}{}_{q}},{{\overset{->}{\phi}}_{i}^{CP}\overset{U}{}_{q}^{z_{t}^{CP}}},\mspace{79mu} {c_{i}^{CP}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{{s_{i}^{CP}{\overset{->}{e}}_{t,1}^{CP}} + {\theta_{i}^{CP}{\overset{->}{v}}_{i}^{CP}}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{0^{w_{t}^{CP}},}\overset{\overset{z_{t}^{CP}}{}}{{\overset{->}{\phi}}_{i}^{CP}}} \right)_{_{t}^{CP}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{CP}} \right)}},{{\overset{->}{\phi}}_{i}^{CP}\overset{U}{}_{q}^{z_{t}^{CP}}},\mspace{79mu} {c_{i}^{CP}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{s_{i}^{CP}{\overset{->}{v}}_{i}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{0^{w_{t}^{CP}},}\overset{\overset{z_{t}^{CP}}{}}{{\overset{->}{\phi}}_{i}^{CP}}} \right)_{_{t}^{CP}}},\mspace{79mu} {c_{d + 1}:={g_{T}^{\zeta}m}},{{{return}\mspace{14mu} {ct}_{({\Gamma^{KP},^{CP}})}}:={\left( {{c_{0};\Gamma^{KP}},{\left\{ c_{t}^{KP} \right\}_{{({t,{\overset{->}{x}}_{t}^{KP}})} \in \Gamma^{KP}};^{CP}},c_{1}^{CP},\ldots \mspace{14mu},{c_{L^{CP}}^{CP};c_{d + 1}}} \right).}}}$

The function and operation of the decryption device 300 will bedescribed.

As shown in FIG. 8, the decryption device 300 is provided with adecryption key acquisition part 310, a data reception part 320 (dataacquisition part), a span program calculation part 330, a complementarycoefficient calculation part 340, a pairing operation part 350, and amessage calculation part 360.

The span program calculation part 330 is provided with a KP span programcalculation part 331 and a CP span program calculation part 332. Thecomplementary coefficient calculation part 340 is provided with a KPcomplementary coefficient calculation part 341 and a CP complementarycoefficient calculation part 342.

The process of the Dec algorithm will be described with reference toFIG. 12.

(S401: Decryption key Acquisition Step)

For example, with the communication device, the decryption keyacquisition part 310 acquires the decryption key sk_((SCP,ΓCP))distributed from the key generation device 100, via the network. Thedecryption key acquisition part 310 also acquires the public parameterspk generated by the key generation device 100.

(S402: Data Reception Step)

For example, with the communication device, the data reception part 320receives the encrypted data ct_((ΓKP,SCP)) transmitted by the encryptiondevice 200, via the network.

(S403: Span Program Calculation Step)

With the processing device, the KP span program calculation part 331checks whether or not the access structure S^(KP) included in thedecryption key sk_((SCP,ΓCP)) acquired in (S401) accepts the attributeset Γ^(KP) included in the encrypted data ct_((ΓKP,SCP)) received in(S402).

Also, with the processing device, the CP span program calculation part332 checks whether or not the access structure S^(CP) included in theencrypted data ct_((ΓKP,SCP)) received in (S402) accepts the attributeset Γ^(CP) included in the decryption key sk_((SCP,ΓCP)) acquired in(S401).

The method of checking whether or not the access structure accepts theattribute set is the same as that described in “3. Concept forImplementing Functional Encryption”.

The span program calculation part 330 advances to the process of (S404)if the access structure S^(KP) accepts the attribute set Γ^(KP) and theaccess structure S^(CP) accepts the attribute set Γ^(CP) (accept inS403). If at least either the access structure S^(KP) rejects theattribute set Γ^(KP) or the access structure S^(CP) rejects theattribute set Γ^(CP) (reject in S403), the span program calculation part330 judges that the encrypted data ct_((ΓKP,SCP)) cannot be decryptedwith the decryption key sk_((SCP,ΓCP)), and outputs the distinguishedsymbol ⊥ and ends the process.

(S404: Complementary Coefficient Calculation Step)

With the processing device, the KP complementary coefficient calculationpart 341 calculates I^(KP) and a constant (complementary coefficient)α_(i) ^(KP) for each integer i included in I^(KP), which I^(KP) andα_(i) ^(KP) satisfying Formula 155.

{right arrow over (1)}=Σ_(iεI)α_(i) ^(KP) M _(i) ^(KP), where M _(i)^(KP) is the i-th row of M ^(KP), and I ^(KP) ⊂{i ε{1, . . . ,L^(KP)}|[ρ^(KP)(i)=(t,{right arrow over (v)}i ^(KP))

(t,{right arrow over (x)} _(t) ^(KP))εΓ^(KP)

{right arrow over (v)} _(i) ^(KP) ·{right arrow over (x)} _(t)^(KP)=0][ρ^(KP)(i)=

(t,{right arrow over (v)}i ^(KP))

(t,{right arrow over (x)} _(t) ^(KP))εΓ^(KP)

{right arrow over (v)} _(i) ^(KP) ·{right arrow over (x)} _(t)^(KP)≠0]}  [Formula 155]

Also, with the processing device, the CP complementary coefficientcalculation part 342 calculates I^(CP) and a constant (complementarycoefficient) α_(i) ^(CP) for each integer i included in I^(CP), whichI^(CP) and α_(i) ^(CP) satisfying Formula 156.

{right arrow over (1)}=Σ_(iεI)α_(i) ^(KP) M _(i) ^(KP), where M _(i)^(KP) is the i-th row of M ^(KP), and I ^(KP) ⊂{i ε{1, . . . ,L^(KP)}|[ρ^(KP)(i)=(t,{right arrow over (v)}i ^(KP))

(t,{right arrow over (x)} _(t) ^(KP))εΓ^(KP)

{right arrow over (v)} _(i) ^(KP) ·{right arrow over (x)} _(t)^(KP)=0][ρ^(KP)(i)=

(t,{right arrow over (v)}i ^(KP))

(t,{right arrow over (x)} _(t) ^(KP))εΓ^(KP)

{right arrow over (v)} _(i) ^(KP) ·{right arrow over (x)} _(t)^(KP)≠0]}  [Formula 156]

(S405: Pairing Operation Step)

The pairing operation part 350 generates a session key K=g_(r) ^(ζ) bycalculating Formula 157 with the processing device.

$\begin{matrix}{K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{\alpha_{i}^{KP} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}} \right)} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}{{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}{\alpha_{i}^{CP} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}{e{\quad{\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right){\alpha_{i}^{CP}/\left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}}}}}}}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 157} \right\rbrack\end{matrix}$

By calculating Formula 157, the key K=g_(T) ^(ζ) is obtained, asindicated in Formula 158.

$\begin{matrix}{K:={{{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}^{\alpha_{i}^{KP}} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}^{\alpha_{i}^{KP}/{({{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}})}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}{{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}^{\alpha_{i}^{CP}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}^{\alpha_{i}^{CP}/{({{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{i}^{CP}})}}}}}}}}}} = {{{g_{T}^{- \varpi}}^{\;^{KP}s_{0}^{KP} - {\delta^{CP}s_{0}^{CP}} + \zeta} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}{g_{T}^{\varpi^{KP}\alpha_{i}s_{i}^{KP}} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{g_{T}^{\varpi}}^{\;^{KP}\alpha_{i}{{s_{i}^{KP}({{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}})}/{({{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}})}}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}{g_{T}^{\delta^{CP}\alpha_{i}s_{i}^{CP}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}{g_{T}^{\delta^{CP}\alpha_{i}s_{i}^{CP}}}^{{({{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{i}^{CP}})}/{({{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}})}}}}}}}}}} = {{g_{T}^{- \varpi}}^{\;^{KP}s_{0}^{KP} - {\delta^{CP}s_{0}^{CP}} + \zeta + {\varpi^{KP}s_{0}^{KP}} + {\delta^{CP}s_{0}^{CP}}} = g_{T}^{\zeta}}}}} & \left\lbrack {{Formula}\mspace{14mu} 158} \right\rbrack\end{matrix}$

(S406: Message Calculation Step)

The message calculation part 360 generates a message m′ (=m) bycalculating m′=c_(d+1)/K with the processing device. Note that messageencrypted data c_(d+1) is g_(T) ^(ζ)m as indicated in Formula 152. SinceK is g_(T) ^(ζ), the message m can be obtained by calculatingm′=c_(d+1)/K.

More specifically, from (S401) through (S406), the decryption device 300generates the message m′(=m) by executing the Dec algorithm indicated inFormula 159.

${{{\left. \mspace{635mu} {\left\lbrack {{Formula}\mspace{14mu} 159} \right\rbrack {{{Dec}\left( {{pk}, {{sk}_{({^{KP},\Gamma^{CP}})}:=\left( {{k_{0}^{*};^{KP}},k_{1}^{*{KP}},\ldots \mspace{14mu},{k_{L^{KP}}^{*{KP}};\Gamma^{CP}},\left\{ k_{t}^{*{CP}} \right\}} \right)_{{({t,{\overset{->}{x}}_{t}^{CP}})} \in \Gamma^{CP}}}} \right)},{{ct}_{({\Gamma^{KP},^{CP}})}:=\left( {{c_{0};\Gamma^{KP}},{\left\{ c_{t}^{KP} \right\}_{{({t,{\overset{->}{x}}_{t}^{KP}})} \in \Gamma^{KP}};^{CP}},c_{1}^{CP},\ldots \mspace{14mu},{c_{L^{CP}}^{CP};c_{d + 1}}} \right)}}} \right):{{If}\mspace{14mu} ^{KP}}}:={{\left( {M^{KP},\rho^{KP}} \right)\mspace{14mu} {accepts}\mspace{14mu} \Gamma^{KP}}:={{\left\{ \left( {t,{\overset{->}{x}}_{t}^{KP}} \right) \right\} \mspace{14mu} {and}\mspace{14mu} ^{CP}}:={{\left( {M^{CP},\rho^{CP}} \right)\mspace{14mu} {accepts}\mspace{14mu} \Gamma^{CP}}:=\left\{ \left( {t,{\overset{->}{x}}_{t}^{CP}} \right) \right\}}}}},{{{then}\mspace{14mu} {compute}\mspace{14mu} \left( {I^{KP},\left\{ \alpha_{i}^{KP} \right\}_{i \in I^{KP}}} \right)\mspace{14mu} {and}\mspace{14mu} \left( {I^{CP},\left\{ \alpha_{i}^{CP} \right\}_{i \in I^{CP}}} \right)\mspace{14mu} {such}\mspace{14mu} {that}\mspace{14mu} \overset{->}{1}} = {\sum\limits_{i \in I}{\alpha_{i}^{KP}M_{i}^{KP}}}},{{where}\mspace{14mu} M_{i}^{KP}\mspace{14mu} {is}\mspace{14mu} {the}\mspace{14mu} i\text{-}{th}\mspace{14mu} {row}\mspace{14mu} {of}\mspace{14mu} M^{KP}},{{{and}\mspace{14mu} I^{KP}} \subseteq \left\{ {{i \in \left\{ {1,\ldots \mspace{14mu},L^{KP}} \right\}}{\left\lbrack {{\rho^{KP}(i)} = {{{\left( {t,{\overset{->}{v}}_{i}^{KP}} \right)\bigwedge\left( {t,{\overset{->}{x}}_{t}^{KP}} \right)} \in {{\Gamma^{KP}\bigwedge{\overset{->}{v}}_{i}^{KP}} \cdot {\overset{->}{x}}_{t}^{KP}}} = 0}} \right\rbrack\bigvee\left\lbrack {{\rho^{KP}(i)} = {{{\left( {t,{\overset{->}{v}}_{i}^{KP}} \right)\bigwedge\left( {t,{\overset{->}{x}}_{t}^{KP}} \right)} \in {{{\Gamma^{KP}\bigwedge{\overset{->}{v}}_{i}^{KP}} \cdot {\overset{->}{x}}_{t}^{KP}} \neq 0}}}} \right\rbrack}} \right\}},{{{and}\mspace{14mu} \overset{->}{1}} = {\sum\limits_{i \in I}{\alpha_{i}^{CP}M_{i}^{CP}}}},{{where}\mspace{14mu} M_{i}^{MP}\mspace{14mu} {is}\mspace{14mu} {the}\mspace{14mu} i\text{-}{th}\mspace{14mu} {row}\mspace{14mu} {of}\mspace{14mu} M^{CP}},{{{and}\mspace{14mu} I^{CP}} \subseteq \left\{ {{i \in \left\{ {1,\ldots \mspace{14mu},L^{CP}} \right\}}{\left\lbrack {{\rho^{CP}(i)} = {{{\left( {t,{\overset{->}{v}}_{i}^{CP}} \right)\bigwedge\left( {t,{\overset{->}{x}}_{t}^{CP}} \right)} \in {{\Gamma^{CP}\bigwedge{\overset{->}{v}}_{i}^{CP}} \cdot {\overset{->}{x}}_{t}^{CP}}} = 0}} \right\rbrack\bigvee\left\lbrack {{\rho^{CP}(i)} = {{{\left( {t,{\overset{->}{v}}_{i}^{CP}} \right)\bigwedge\left( {t,{\overset{->}{x}}_{t}^{CP}} \right)} \in {{{\Gamma^{CP}\bigwedge{\overset{->}{v}}_{i}^{CP}} \cdot {\overset{->}{x}}_{t}^{CP}} \neq 0}}}} \right\rbrack}} \right\}},{K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{\alpha_{i}^{KP} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}^{\alpha_{i}^{KP}/{({{\overset{->}{v}}_{i}^{KP} \cdot {\overset{->}{x}}_{t}^{KP}})}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}{{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}^{\alpha_{i}^{CP}} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}{{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}_{i}^{\alpha^{CP}}/\left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}}}}}}},\mspace{79mu} {{{return}\mspace{14mu} m^{\prime}}:={c_{d + 1}/{K.}}}}\mspace{20mu}$

As described above, the cryptographic processing system 10 implementsthe encryption scheme (functional encryption scheme) using the accessstructures S^(KP) and S^(CP) constructed using the span program,inner-product predicate, and secret sharing. Therefore, thecryptographic processing system 10 implements an encryption scheme thatcan design access control with a very high degree of freedom.

In particular, the cryptographic processing system 10 imparts the accessstructure S^(KP) to the decryption key and the access structure S^(CP)to the encrypted data. Thus, the cryptographic processing system 10 canconduct access control in terms of both the decryption key and theencrypted data.

In the above description, the dimensions u_(t), w_(t), and z_(t) (t=0, .. . , d+1) are provided to enhance the security. Therefore, if thedimensions u_(t), w_(t), and z_(t) (t=0, . . . , d+1) are each set to 0,the dimensions u_(t), w_(t), and z_(t) (t=0, d+1) need not be provided,although the security may be degraded.

In the above description, in (S101), 2+u₀+1+w₀+z₀ is set in N₀.Alternatively, 2+u₀+1+w₀+z₀ may be replaced by 2+2+1+2+1, and 8 may beset in N₀.

In the above description, in (S101), n_(t) ^(KP)+u_(t) ^(KP)+w_(t)^(KP)+z_(t) ^(KP) is set in N_(t) ^(KP). Alternatively, n_(t)^(KP)+u_(t) ^(KP)+w_(t) ^(KP)+z_(t) ^(KP) may be replaced by n_(t)^(KP)+n_(t) ^(KP)+n_(t) ^(KP)+1, and 3n_(t) ^(KP)+1 may be set in N_(t)^(KP).

Similarly, in (S101), n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+z_(t) ^(CP) isset in N_(t) ^(CP). Alternatively, n_(t) ^(CP)+u_(t) ^(CP)+w_(t)^(CP)+z_(t) ^(CP) may be replaced by n_(t) ^(CP)+n_(t) ^(CP)+n_(t)^(CP)+1, and 3n_(t) ^(CP) may be set in N_(t) ^(CP).

In this case, the Setup algorithm indicated in Formula 136 is rewrittenas indicated in Formula 160. Note that G_(ob) ^(UP) is written asindicated in Formula 161.

${\left. \mspace{635mu} {{\left\lbrack {{Formula}\mspace{14mu} 160} \right\rbrack {{{{Setup}\left( {1^{\lambda},{\overset{->}{n}:=\left( {\left( {{d^{KP};n_{1}^{KP}},\ldots \mspace{14mu},n_{d^{KP}}^{KP}} \right),\left( {{d^{CP};n_{1}^{CP}},\ldots \mspace{14mu},n_{d^{CP}}^{CP}} \right)} \right)}} \right)}:{\left( {{param}_{\overset{->}{n}},_{0},_{0}^{*},\left\{ {_{t}^{KP},_{t}^{*{KP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {_{t}^{CP},_{t}^{*{CP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right)\overset{R}{}{_{ob}\left( {1^{\lambda},\overset{->}{n}} \right)}}},\mspace{79mu} {{\hat{}}_{0}:=\left( {b_{0,1},b_{0,2},b_{0,5},b_{0,8}} \right)},{{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,5}^{*},b_{0,6}^{*},b_{0,7}^{*}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{\hat{}}_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{KP},b_{t,{{3n_{t}^{KP}} + 1}}^{KP}} \right)},{{\hat{}}_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,n_{t}^{KP}}^{*{KP}},b_{t,{{2n_{t}^{KP}} + 1}}^{*{KP}},\ldots \mspace{14mu},b_{t,{3n_{t}^{KP}}}^{*{KP}}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{\hat{}}_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{CP},b_{t,{{3n_{t}^{CP}} + 1}}^{CP}} \right)},{{\hat{}}_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,n_{t}^{CP}}^{*{CP}},b_{t,{{2n_{t}^{CP}} + 1}}^{*{CP}},\ldots \mspace{14mu},b_{t,{3n_{t}^{CP}}}^{*{CP}}} \right)},\mspace{79mu} {{pk}:=\left( {1^{\lambda},{param}_{\overset{->}{n}},{\hat{}}_{0},\left\{ {\hat{}}_{t}^{KP} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {\hat{}}_{t}^{CP} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right)},{{sk}:=\left( {{\hat{}}_{0}^{*},\left\{ {\hat{}}_{t}^{*{KP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {\hat{}}_{t}^{*{CP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right)}}\mspace{79mu} {{{return}\mspace{14mu} {pk}},{{sk}.\mspace{560mu} \left\lbrack {{Formula}\mspace{14mu} 161} \right\rbrack}}{_{ob}^{up}\left( {1^{\lambda},{\overset{->}{n}:={{\left( {\left( {{d^{KP};n_{1}^{KP}},\ldots \mspace{14mu},n_{d^{KP}}^{KP}} \right),\left( {{d^{CP};n_{1}^{CP}},\ldots \mspace{14mu},n_{d^{CP}}^{CP}} \right)} \right):{param}_{}}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}}},{\psi \overset{U}{}_{q}^{X}},{N_{0}:=8},{N_{t}^{KP}:={{{3n_{t}^{KP}} + {1\mspace{14mu} {for}\mspace{14mu} t}} = 1}},\ldots \mspace{14mu},d^{KP},{N_{t}^{CP}:={{{3n_{t}^{CP}} + {1\mspace{14mu} {for}\mspace{14mu} t}} = 1}},\ldots \mspace{14mu},d^{CP},{{param}_{V_{0}}:={\left( {q,_{0},_{T},_{0},e} \right):={_{dpvs}\left( {1^{\lambda},N_{0},{param}_{}} \right)}}},{X_{0}:={\left( \chi_{0,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{0},_{q}} \right)}}},{\left( v_{0,i,j} \right)_{i,j}:={\psi \cdot \left( X_{0}^{T} \right)^{- 1}}},{b_{0,i}:=\left( {\chi_{0,i,1},\ldots \mspace{14mu},\chi_{0,i,N_{0}}} \right)_{_{0}}},{_{0}:=\left( {b_{0,1},\ldots \mspace{14mu},b_{0,N_{0}}} \right)},{b_{0,i}^{*}:=\left( {v_{0,i,1},\ldots \mspace{14mu},v_{0,i,N_{0}}} \right)_{_{0}}},{_{0}^{*}:=\left( {b_{0,i}^{*},\ldots \mspace{14mu},b_{0,N_{0}}^{*}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{KP},{{param}_{_{t}^{KP}}:={\left( {q,_{t}^{KP},_{T},_{t}^{KP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{KP},{param}_{}} \right)}}},{X_{t}^{KP}:={\left( \chi_{t,i,j}^{KP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{KP},_{q}} \right)}}},{\left( v_{t,i,j}^{KP} \right)_{i,j}:={\psi \cdot \left( X_{t}^{KP} \right)^{T}}}} \right)}\,^{- 1}},{b_{t,i}^{KP}:=\left( {\chi_{t,i,1}^{KP},\ldots \mspace{14mu},\chi_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},{_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \mspace{14mu},b_{t,i,N_{t}^{KP}}^{KP}} \right)},{b_{t,i}^{*{KP}}:=\left( {v_{t,i,1}^{KP},\ldots \mspace{14mu},v_{t,i,N_{t}^{KP}}^{KP}} \right)_{_{t}^{KP}}},{_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \mspace{14mu},b_{t,N_{t}^{KP}}^{*{KP}}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d^{CP},{{param}_{_{t}^{CP}}:={\left( {q,_{t}^{CP},_{T},_{t}^{CP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{CP},{param}_{}} \right)}}},{X_{t}^{CP}:={\left( \chi_{t,i,j}^{CP} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t}^{CP},_{q}} \right)}}},{\left( v_{t,i,j}^{CP} \right)_{i,j}:={\psi \cdot \left( X_{t}^{CP} \right)^{T}}}} \right)\,^{- 1}},{b_{t,i}^{CP}:=\left( {\chi_{t,i,1}^{CP},{\ldots \mspace{14mu} \chi_{t,i,N_{t}^{CP}}^{CP}}} \right)_{_{t}^{CP}}},{_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \mspace{14mu},b_{t,i,N_{t}^{CP}}^{CP}} \right)},{b_{t,i}^{*{CP}}:=\left( {v_{t,i,1}^{CP},\ldots \mspace{14mu},v_{t,i,N_{t}^{CP}}^{CP}} \right)_{_{t}^{CP}}},{_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \mspace{14mu},b_{t,N_{t}^{CP}}^{*{CP}}} \right)},{g_{T}:={e\left( {g,g} \right)}^{\psi}},{{param}_{\overset{->}{n}}:={\left( {{param}_{_{0}},\left\{ {param}_{_{t}^{KP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},{\left\{ {param}_{_{t}^{CP}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP},}g_{T}}} \right){return}\mspace{14mu} {\left( {{param}_{\overset{->}{n}},\left\{ {_{0},_{0}^{*}} \right\},\left\{ {_{t}^{KP},_{t}^{*{KP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{KP}},\left\{ {_{t}^{CP},_{t}^{*{CP}}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d^{CP}}} \right).^{\;}}}}$

Also, the KeyGen algorithm indicated in Formula 144 is rewritten asindicated in Formula 162.

                                    [Formula  162]${KeyGen}\left( {{pk},{sk},{^{KP}:=\left( {M^{KP},\rho^{KP}} \right)},{\Gamma^{CP}:=\left\{ {{\left( {t,{{\overset{->}{x}}_{t}^{CP}:={\left( {x_{t,1}^{CP},\ldots \mspace{14mu},x_{t,n_{t}^{CP}}^{CP}} \right) \in {_{q}^{n_{t}^{CP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right){1 \leq t \leq d^{CP}}},{x_{t,1}^{CP}:=1}} \right\}}} \right)$$\mspace{79mu} {{{\overset{->}{f}}^{KP}\overset{U}{}_{q}^{r^{KP}}},{\left( {\overset{->}{s}}^{KP} \right)^{T}:={\left( {s_{1}^{KP},\ldots \mspace{14mu},s_{L^{KP}}^{KP}} \right)^{T}:={M^{KP} \cdot \left( {\overset{->}{f}}^{KP} \right)^{T}}}},\mspace{79mu} {s_{0}^{KP}:={\overset{->}{1} \cdot \left( {\overset{->}{f}}^{KP} \right)^{T}}},\mspace{79mu} {\delta^{CP}\overset{U}{}_{q}},{{{\overset{->}{\eta}}_{t}^{CP}\overset{U}{}_{q}^{n_{t}^{CP}}}\mspace{14mu} {such}\mspace{14mu} {that}}}$$\mspace{79mu} {{\left( {t,{\overset{->}{x}}_{t}^{CP}} \right) \in \Gamma^{CP}},\mspace{79mu} {\left( {\eta_{0,1},\eta_{0,2}} \right)\overset{U}{}_{q}^{2}},\mspace{79mu} {k_{0}^{*}:=\left( {{- s_{0}^{KP}},\delta^{CP},0,0,1,\eta_{0,1},\eta_{0,2},0} \right)_{_{0}^{*}}},\mspace{79mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{KP},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{KP}(i)}} = \left( {t,{{\overset{->}{v}}_{i}^{KP}:={\left( {v_{i,1}^{KP},\ldots \mspace{14mu},v_{i,n_{t}^{KP}}^{KP}} \right) \in {_{q}^{n_{t}^{KP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right)},\mspace{79mu} {\theta_{i}^{KP}\overset{U}{}_{q}},{{\overset{->}{\eta}}_{i}^{KP}\overset{U}{}_{q}^{n_{t}^{KP}}},\mspace{79mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{{s_{i}^{KP}{\overset{->}{e}}_{t,1}^{KP}} + {\theta_{i}^{KP}{\overset{->}{v}}_{i}^{KP}}},}\overset{\overset{n_{t}^{KP}}{}}{0^{n_{t}^{KP}},}\overset{\overset{n_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{1}{}}{0}} \right)_{_{t}^{*{KP}}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{KP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{KP}} \right)}},{{\overset{->}{\eta}}_{i}^{KP}\overset{U}{}_{q}^{n_{t}^{KP}}},\mspace{79mu} {k_{i}^{*{KP}}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{s_{i}^{KP}{\overset{->}{v}}_{i}^{KP}},}\overset{\overset{n_{t}^{KP}}{}}{0^{n_{t}^{KP}},}\overset{\overset{n_{t}^{KP}}{}}{{\overset{->}{\eta}}_{i}^{KP},}\overset{\overset{1}{}}{0}} \right)_{_{t}^{*{KP}}}},\mspace{79mu} {{{for}\mspace{14mu} \left( {t,{\overset{->}{x}}_{t}^{CP}} \right)} \in \Gamma^{CP}},\mspace{79mu} {k_{t}^{*{CP}}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{\delta^{CP}{\overset{->}{x}}_{t}^{CP}},}\overset{\overset{n_{t}^{CP}}{}}{0^{n_{t}^{CP}},}\overset{\overset{n_{t}^{CP}}{}}{{\overset{->}{\eta}}_{t}^{CP},}\overset{\overset{1}{}}{0}} \right)_{_{t}^{*{CP}}}},{{{return}\mspace{14mu} {sk}_{({^{KP},\Gamma^{CP}})}}:={\left( {{k_{0}^{*};^{KP}},k_{1}^{*{KP}},\ldots \mspace{14mu},{k_{L^{KP}}^{*{KP}};\Gamma^{CP}},\left\{ k_{t}^{*{CP}} \right\}_{{({t,{\overset{->}{x}}_{t}^{CP}})} \in \Gamma^{CP}}} \right).}}}$

Also, the Enc algorithm indicated in Formula 154 is rewritten asindicated in Formula 163.

                                    [Formula  163]${{{Enc}\left( {{pk},m,{\Gamma^{KP}:=\left\{ {{\left( {t,{{\overset{->}{x}}_{t}^{KP}:={\left( {x_{t,1}^{KP},\ldots \mspace{14mu},x_{t,n_{t}^{KP}}^{KP}} \right) \in {_{q}^{n_{t}^{KP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right){1 \leq t \leq d^{KP}}},{x_{t,1}^{KP}:=1}} \right\}},{^{CP}:=\left( {M^{CP},\rho^{CP}} \right)}} \right)}:\omega^{KP}},\phi_{0},\phi_{t}^{KP},{\zeta \overset{U}{}_{q}}$     for$\mspace{79mu} {{\left( {t,{\overset{->}{x}}_{t}^{KP}} \right) \in \Gamma},\mspace{79mu} {{\overset{->}{f}}^{CP}\overset{R}{}_{q}^{r^{CP}}},{\left( {\overset{->}{s}}^{CP} \right)^{T}:={\left( {s_{1}^{CP},\ldots \mspace{14mu},s_{L^{CP}}^{CP}} \right)^{T}:={M^{CP} \cdot \left( {\overset{->}{f}}^{CP} \right)^{T}}}},\mspace{79mu} {s_{0}^{CP}:={\overset{->}{1} \cdot \left( {\overset{->}{f}}^{CP} \right)^{T}}},\mspace{79mu} {c_{0}:=\left( {\omega^{KP},{- s_{0}^{CP}},0,0,\zeta,0,0,\phi_{0}} \right)_{_{0}}},\mspace{79mu} {for}}$$\mspace{79mu} {{\left( {t,{\overset{->}{x}}_{t}^{KP}} \right) \in \Gamma^{KP}},\mspace{79mu} {c_{t}^{KP}:=\left( {\overset{\overset{n_{t}^{KP}}{}}{{\omega^{KP}{\overset{->}{x}}_{t}^{KP}},}\overset{\overset{n_{t}^{KP}}{}}{0^{n_{t}^{KP}},}\overset{\overset{n_{t}^{KP}}{}}{0^{n_{t}^{KP}},}\overset{\overset{1}{}}{\phi_{t}^{KP}}} \right)_{_{t}^{KP}}},\mspace{79mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L^{CP},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,{{\overset{->}{v}}_{i}^{CP}:={\left( {v_{i,1}^{CP},\ldots \mspace{14mu},v_{i,n_{t}^{CP}}^{CP}} \right) \in {_{q}^{n_{t}^{CP}}\backslash \left\{ \overset{->}{0} \right\}}}}} \right)\left( {v_{i,n_{t}^{CP}}^{CP}:=1} \right)}},\mspace{79mu} \phi_{i}^{CP},{\theta_{i}^{CP}\overset{U}{}_{q}},\mspace{79mu} {c_{i}^{CP}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{{s_{i}^{CP}{\overset{->}{e}}_{t,1}^{CP}} + {\theta_{i}^{CP}{\overset{->}{v}}_{i}^{CP}}},}\overset{\overset{n_{t}^{CP}}{}}{0^{n_{t}^{CP}},}\overset{\overset{n_{t}^{CP}}{}}{0^{n_{t}^{CP}},}\overset{\overset{1}{}}{\phi_{i}^{CP}}} \right)_{_{t}^{CP}}},\mspace{79mu} {{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,{\overset{->}{v}}_{i}^{CP}} \right)}},{\phi_{i}^{CP}\overset{U}{}_{q}},\mspace{79mu} {c_{i}^{CP}:=\left( {\overset{\overset{n_{t}^{CP}}{}}{{s_{i}^{CP}{\overset{->}{v}}_{i}^{CP}},}\overset{\overset{n_{t}^{CP}}{}}{0^{n_{t}^{CP}},}\overset{\overset{n_{t}^{CP}}{}}{0^{n_{t}^{CP}},}\overset{\overset{1}{}}{\phi_{i}^{CP}}} \right)_{_{t}^{CP}}},\mspace{79mu} {c_{d + 1}:={g_{T}^{\zeta}m}},{{{return}\mspace{14mu} {ct}_{({\Gamma^{KP},^{CP}})}}:={\left( {{c_{0};\Gamma^{KP}},{\left\{ c_{t}^{KP} \right\}_{{({t,{\overset{->}{x}}_{t}^{KP}})} \in \Gamma^{KP}};^{CP}},c_{1}^{CP},\ldots \mspace{14mu},{c_{L^{CP}}^{CP};c_{d + 1}}} \right).}}}$

Note that the Dec algorithm indicated in Formula 159 remains unchanged.

Also, in the above description, in (S101), 8 is set in N₀. However, N₀need not be 8 but may be an integer of 3 or more. When N₀ is 3, thebases B₀ and B*₀ become two-dimensional. In the case where N₀ is 3,k*₀:=(−s₀ ^(KP), δ^(CP), 1))_(B*0) may be set in the KeyGen algorithmand c₀:=(ω^(KP), −s₀ ^(CP), ζ)_(B)0 may be set in the Enc algorithm.Note that B*0 represents B*₀ and that B0 represents B₀.

In the above description, k*₀:=(−s₀, δ^(CP), 0, 0, 1, η_(0,1), η_(0,2),0)_(B*0) is set in the KeyGen algorithm. Alternatively, by employing apredetermined value K that can be known to the encryption device 200,k*₀:=(−s₀, δ^(CP), 0, 0, κ, η_(0,1), η_(0,2), 0)_(B*0) may be set. Notethat B*0 represents B*₀ and that B0 represents B₀. In this case, sinceK:=g^(ζκ) _(T) is calculated in the Dec algorithm, c_(d+1):=g^(ζκ) _(T)mmay be set in the Enc algorithm.

In the above description, the value of v_(i,ntCP) ^(CP) (where ntCPrepresents n_(t) ^(CP)) is not particularly limited. However, alimitation of v_(i,ntCP) ^(CP):=1 may be placed from the viewpoint ofsecurity proof

From the viewpoint of security proof ρ^(˜KP)(i) for each integer i=1, .. . , L^(KP) may be limited to a positive tuple (t, v^(→) _(i) ^(KP)) ornegative tuple

(t, v^(→) _(i) ^(KP)) for different identification information t.

In other words, let a function ρ^(˜KP) be map of {1, . . . , L}→{1, . .. , d^(KP)} with which ρ^(˜KP)(i)=t is established when ρ^(KP)(i)=(t,v^(→) _(i) ^(KP)) or ρ^(KP)(i)=

(t, v^(→) _(i) ^(KP)). In this case, ρ^(˜KP) may be limited toinjection. Note that ρ^(KP)(i) is ρ^(KP)(i) in the access structureS^(KP):=(M^(KP), ρ^(KP)(i)) described above.

Similarly, ρ^(CP)(i) for each integer i=1, . . . , L^(CP) may be limitedto a positive tuple (t, v^(→) _(i) ^(CP)) or negative tuple

(t, v^(→) _(i) ^(KP)) for different identification information t.

In other words, let a function ρ^(˜CP) be map of {1, . . . , L}→{1, . .. , d^(CP)} with which ρ^(˜CP)(i)=t is established when ρ^(CP)(i)=(t,v^(→) _(i) ^(KP)) or ρ^(KP)(i)=

(t, v^(→) _(i) ^(KP)). In this case, ρ^(˜CP) may be limited toinjection. Note that ρ^(CP)(i) is ρ^(CP)(i) in the access structureS^(CP):=(M^(CP), ρ^(CP)(i)) described above.

The Setup algorithm may be executed only once at the setup of thecryptographic processing system 10, and need not be executed every timea decryption key is to be generated. In the above description, the Setupalgorithm and the KeyGen algorithm are executed by the key generationdevice 100. Alternatively, the Setup algorithm and the KeyGen algorithmmay be executed by different devices respectively.

In the above description, the span program M̂ accepts the input sequenceδ if and only if linear combination of the rows of the matrix M_(δ)obtained from the matrix ̂ by the input sequence δ gives 1^(→).Alternatively, the span program M̂ may accept the input sequence δ onlyif another vector h^(→) is obtained instead of 1^(→).

In this case, in the KeyGen algorithm, s₀:=h^(→KP)·(f^(→KP)))^(T) may beset instead of s₀:=1^(→)·(f^(→KP)))^(T). Likewise, in the Enc algorithm,s₀:=h^(→CP)·(f^(→CP)))^(T) may be set instead of s₀^(CP):=1^(→)·(f^(→CP)))^(T).

Embodiment 2

In the above embodiment, the method of implementing the cryptographicprocess in the dual vector spaces has been described. In Embodiment 2, amethod of implementing a cryptographic process in dual additive groupswill be described.

More specifically, in the above embodiment, the cryptographic process isimplemented in the cyclic group of the prime order q. When a ring R isexpressed using a composite number M as indicated in Formula 164, thecryptographic process described in the above embodiment can also beapplied to an additive group having the ring R as a coefficient.

:=

/M

  [Formula 164]

where

: an integer; andM: a composite number

For example, when the unified-policy functional encryption described inEmbodiment 1 is implemented in an additive group having a ring R as acoefficient, then Formulas 165 to 169 are resulted.

$\begin{matrix}{{_{ob}^{up}\left( {1^{\lambda},{\overset{\rightarrow}{n}:={{\left( {\left( {{d^{KP};n_{t}^{KP}},u_{t}^{KP},w_{t}^{KP},{z_{t}^{KP}\left( {{t = 1},\ldots \;,d^{KP}} \right)}} \right),\left( {{d^{CP};n_{t}^{CP}},u_{t}^{CP},w_{t}^{CP},{z_{t}^{CP}\left( {{t = 1},\ldots \;,d^{CP}} \right)}} \right)} \right):\mspace{20mu} {param}_{G}}:={\left( {q,G,G_{T},g,e} \right)\overset{R}{\leftarrow}{_{bpg}\left( 1^{\lambda} \right)}}}},{\psi \overset{U}{\leftarrow}R^{X}},\mspace{20mu} {N_{0}:={2 + u_{0} + 1 + w_{0} + z_{0}}},{N_{t}^{KP}:={{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + {z_{t}^{KP}\mspace{14mu} {for}\mspace{14mu} t}} = 1}},\ldots \;,d^{KP},{N_{t}^{CP}:={{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + {z_{t}^{CP}\mspace{14mu} {for}\mspace{14mu} t}} = 1}},\ldots \;,d^{CP},{{param}_{V_{0}}:={\left( {q,{V_{0}G_{T}},A_{0},e} \right):={_{dpvs}\left( {1^{\lambda},N_{0},{param}_{G}} \right)}}},{X_{0}:={\left( \chi_{0,i,j} \right)_{i,j}\overset{\mspace{14mu} U}{\leftarrow}{{GL}\left( {N_{0}R} \right)}}},{\left( v_{0,i,j} \right)_{i,j}:={\psi \cdot \left( X_{0}^{T} \right)^{- 1}}},{b_{0,i}:={\left( {\chi_{0,i,1},\ldots \;,\chi_{0,i,N_{0}}} \right)A_{0}}},{B_{0}:=\left( {b_{0,1},\ldots \;,b_{0},N_{0}} \right)},{b_{0,i}^{*}:={\left( {v_{0,i,1},\ldots \;,v_{0,i,N_{0}}} \right)A_{0}}},{B_{0}^{*}:=\left( {b_{0,1}^{*},\ldots \;,b_{0}^{*},N_{0}} \right)},\mspace{20mu} {{{for}\mspace{14mu} t} = 1},\ldots \;,d^{KP},{{param}_{V_{t}^{KP}}:={\left( {q,V_{t}^{KP},G_{T},A_{t}^{KP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{KP},{param}_{G}} \right)}}},{X_{t}^{KP}:=\left. \left( \chi_{t,i,j}^{KP} \right)_{i,j}\leftarrow{{GL}\left( {N_{t}^{KP},F_{q}} \right)} \right.},{\left( V_{t,i,j}^{KP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{KP} \right)^{T} \right)^{- 1}}},{b_{t,i}^{KP}:={\left( {\chi_{t,i,1}^{KP},\ldots \;,\chi_{t,i,N_{t}^{KP}}^{KP}} \right)A_{t}^{KP}}},{B_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \;,b_{t,N_{t}^{KP}}^{KP}} \right)},{b_{t,i}^{*{KP}}:={\left( {v_{t,i,1}^{KP},\ldots \;,v_{t,i,N_{t}^{KP}}^{KP}} \right)A_{t}^{KP}}},{B_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \;,b_{t,N_{t}^{KP}}^{*{KP}}} \right)},\mspace{20mu} {{{for}\mspace{14mu} t} = 1},\ldots \;,d^{CP},{{param}_{V_{t}^{CP}}:={\left( {q,V_{t}^{CP},G_{T},A_{t}^{CP},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t}^{CP},{param}_{G}} \right)}}},{X_{t}^{CP}:={\left( \chi_{t,i,j}^{CP} \right)_{i,j}\overset{\mspace{11mu} U\mspace{11mu}}{\leftarrow}{{GL}\left( {N_{t}^{CP},F_{q}} \right)}}},{\left( v_{t,i,j}^{CP} \right)_{i,j}:={\psi \cdot \left( \left( X_{t}^{CP} \right)^{T} \right)^{- 1}}},{b_{t,i}^{CP}:={\left( {\chi_{t,i,1}^{CP},\ldots \;,\chi_{t,i,N_{i}^{CP}}^{CP}} \right)A_{i}^{CP}}},{B_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \;,b_{t,N_{t}^{CP}}^{CP}} \right)},{b_{t,i}^{*{CP}}:={\left( {v_{t,i,1}^{CP},\ldots \;,v_{t,i,N_{i}^{CP}}^{CP}} \right)A_{i}^{CP}}},{B_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \;,b_{t,N_{t}^{CP}}^{*{CP}}} \right)},\mspace{20mu} {g_{T}:={{e\left( {g,g} \right)}\psi}},{{param}_{\overset{\rightarrow}{n}}:={\left( {{param}_{V_{0}},\left\{ {param}_{V_{t}^{KP}} \right\}_{{t = 1},\ldots \;,d^{KP}},\left\{ {param}_{V_{t}^{CP}} \right\}_{{t = 1},\ldots \;,d^{CP}},g_{T}} \right){{return}\left( {{param}_{\overset{\rightarrow}{n}},\left\{ {B_{0},B_{0}^{*}} \right\},B_{t}^{KP},B_{t}^{*{KP}}} \right\}}_{{t = 1},\ldots \;,d^{KP}}}},\left\{ {B_{t}^{CP},B_{t}^{*{CP}}} \right)_{{t = 1},\ldots \;,d^{CP}}} \right)}.} & \left\lbrack {{Formula}\mspace{14mu} 165} \right\rbrack\end{matrix}$

$\begin{matrix}{{Setup}\left( {1^{\lambda},{\overset{\rightarrow}{n}:=\left( {\left( {{d^{KP};n_{t}^{KP}},u_{t}^{KP},w_{t}^{KP},{z_{t}^{KP}\left( {{t = 1},\ldots \;,d^{KP}} \right)}} \right),{\left( \left( {{d^{CP};n_{t}^{CP}},u_{t}^{CP},w_{t}^{CP},{z_{t}^{CP}\left( {{t = 1},\ldots \;,d^{CP}} \right)}} \right) \right):\left. \left( {{param}_{\overset{\rightarrow}{n}},B_{0},{B_{0}^{*}\left\{ {B_{t}^{KP},B_{t}^{*{KP}}} \right\}_{{t = 1},\ldots,d^{KP}}},\left\{ {B_{t}^{CP},B_{t}^{*{CP}}} \right\}_{{t = 1},\ldots \;,d^{CP}}} \right)\leftarrow{_{ob}\left( {1^{\lambda},\overset{\rightarrow}{n}} \right)} \right.},{{\hat{B}}_{0}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,{2 + u_{0} + 1}}^{*},b_{0,{2 + u_{0} + 1 + w_{0} + 1}}^{*},\ldots \;,b_{0,{2 + u_{0} + 1 + w_{0} + z_{0}}}^{*}} \right)},{{\hat{B}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,2}^{*},b_{0,{2 + u_{0} + 1}}^{*},b_{0,{2 + u_{0} + 1 + 1}}^{*},\ldots \;,b_{0,{2 + u_{0} + 1 + w_{0}}}^{*}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \;,d^{KP},{{\hat{B}}_{t}^{KP}:=\left( {b_{t,1}^{KP},\ldots \;,b_{t,n_{t}^{KP}}^{KP},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + 1}}^{KP},\ldots \;,b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + z_{t}^{KP}}}^{KP}} \right)},{{\hat{B}}_{t}^{*{KP}}:=\left( {b_{t,1}^{*{KP}},\ldots \;,b_{t,n_{t}^{KP}}^{*{KP}},b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP} + 1}}^{*{KP}},\ldots \;,b_{t,{n_{t}^{KP} + u_{t}^{KP} + w_{t}^{KP}}}^{*{KP}}} \right)},{{{for}\mspace{14mu} t} = 1},\ldots \;,d^{CP},{{\hat{B}}_{t}^{CP}:=\left( {b_{t,1}^{CP},\ldots \;,b_{t,n_{t}^{CP}}^{CP},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + 1}}^{CP},\ldots \;,b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + z_{t}^{CP}}}^{CP}} \right)},{{\hat{B}}_{t}^{*{CP}}:=\left( {b_{t,1}^{*{CP}},\ldots \;,b_{t,n_{t}^{CP}}^{*{CP}},b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP} + 1}}^{*{CP}},\ldots \;,b_{t,{n_{t}^{CP} + u_{t}^{CP} + w_{t}^{CP}}}^{*{CP}}} \right)},{{pk}:=\left( {1^{\lambda},{param}_{\overset{\rightarrow}{n}},{\hat{B}}_{0},\left\{ {\hat{B}}_{t}^{KP} \right\}_{{t = 1},\ldots \;,d^{KP}},\left\{ {\hat{B}}_{t}^{CP} \right\}_{{t = 1},\ldots \;,d^{CP}}} \right)},{{sk}:={\left( {{\hat{B}}_{0},\left\{ {\hat{B}}_{t}^{KP} \right\}_{{t = 1},\ldots \;,d^{KP}},\left\{ {\hat{B}}_{t}^{CP} \right\}_{{t = 1},\ldots \;,d^{CP}}} \right){return}\mspace{14mu} p\; k}},{{sk}.}} \right.}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 166} \right\rbrack\end{matrix}$

$\begin{matrix}{{KeyGen}\left( {{p\; k},{sk},{S^{KP}:=\left( {M^{KP},\rho^{KP}} \right)},{\Gamma^{CP}:={{\left\{ {\left( {t,{{\overset{\rightarrow}{x}}_{t}^{CP}:={\left( {x_{t,1}^{CP},\ldots \;,x_{t,n_{t}^{CP}}^{CP}} \right) \in {R^{n_{t}^{CP}}\backslash \left\{ \overset{\rightarrow}{0} \right\}}}}} \right)\left. {{1 \leq t \leq d^{CP}},{x_{t,1}^{CP}:=}} \right\}} \right){\overset{\rightarrow}{f}}^{KP}}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R^{r^{KP}}}},{\left( s^{KP} \right)^{T}:={\left( {s_{1}^{KP},\ldots \;,s_{L^{KP}}^{KP}} \right)^{T}:={M^{KP} \cdot \left( {\overset{\rightarrow}{f}}^{KP} \right)^{T}}}},{s_{0}^{KP}:={1 \cdot \left( {\overset{\rightarrow}{f}}^{KP} \right)^{T}}},{\delta^{CP}\overset{\mspace{20mu} U\mspace{11mu}}{\leftarrow}R},{{{\overset{\rightarrow}{\eta}}_{t}^{CP}\overset{\mspace{20mu} U\mspace{11mu}}{\leftarrow}{R^{w_{t}^{CP}}\mspace{14mu} {such}\mspace{14mu} {that}\mspace{14mu} \left( {t,x_{t}^{CP}} \right)}} \in \Gamma^{CP}},{{\overset{\rightarrow}{\eta}}_{0}\overset{\mspace{20mu} U\mspace{11mu}}{\leftarrow}R^{w_{0}}},{k_{0}^{*}:={\left( {{- s_{0}^{KP}},\delta^{CP},\overset{\overset{u_{0}}{}}{0^{u_{0}}},1,{\overset{\overset{w_{0}}{}}{\eta_{0,1},\ldots \;,\eta_{0,w_{0}},}\overset{\overset{z_{0}}{}}{0^{z_{0}}}}} \right)B_{0}^{*}}},{{{for}\mspace{14mu} i} = 1},\ldots \;,L^{KP},{{{if}\mspace{14mu} {\rho^{KP}(i)}} = \left( {t,{{\overset{\rightarrow}{v}}_{i}^{KP}:={\left( {v_{i,1}^{KP},\ldots \;,v_{i,n_{t}^{KP}}^{KP}} \right) \in {R^{n_{t}^{KP}}\backslash \left\{ \overset{\rightarrow}{0} \right\}}}}} \right)},{\theta_{i}^{KP}\overset{\mspace{20mu} U\mspace{11mu}}{\leftarrow}R},{{\overset{\rightarrow}{\eta}}_{i}^{KP}\overset{\mspace{20mu} U\mspace{11mu}}{\leftarrow}R^{w_{t}^{KP}}},{k_{i}^{*{KP}}:={\overset{\overset{n_{t}^{KP}}{}}{\left( {{{s_{i}^{KP}e_{t,1}^{KP}} + {\theta_{i}^{KP}v_{i}^{KP}}},} \right.}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{\rightarrow}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{\left. 0^{z_{t}^{KP}} \right)}B_{t}^{*{KP}}}},{{{if}\mspace{14mu} {\rho^{KP}(i)}} = {\left( {t,{\overset{\rightarrow}{v}}_{i}^{KP}} \right)}},{\eta_{i}^{KP}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R^{w_{t}^{KP}}},{k_{i}^{*{KP}}:={\overset{\overset{n_{t}^{KP}}{}}{\left( {{s_{i}^{KP}{\overset{\rightarrow}{v}}_{t,1}^{KP}},} \right.}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{{\overset{\rightarrow}{\eta}}_{i}^{KP},}\overset{\overset{z_{t}^{KP}}{}}{\left. 0^{z_{t}^{KP}} \right)}B_{t}^{*{KP}}}},{{{for}\mspace{14mu} \left( {t,x_{t}^{CP}} \right)} \in \Gamma^{CP}},{k_{t}^{*{CP}}:={\overset{\overset{n_{t}^{CP}}{}}{\left( {{\delta^{CP}{\overset{\rightarrow}{x}}_{t}^{CP}},} \right.}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{{\overset{\rightarrow}{\eta}}_{t}^{CP},}\overset{\overset{z_{t}^{CP}}{}}{\left. 0^{z_{t}^{KP}} \right)}B_{t}^{*{CP}}}},{{{return}\mspace{14mu} {sk}_{({S^{KP},\Gamma^{CP}})}}:={\left( {{k_{0}^{*};S^{KP}},k_{1}^{*{KP}},\ldots \;,{k_{L}^{*{KP}};\Gamma^{CP}},\left\{ k_{t}^{*{CP}} \right\}_{{({t,{\overset{\rightarrow}{x}}_{t}^{CP}})} \in \Gamma^{CP}}} \right).}}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 167} \right\rbrack\end{matrix}$

$\begin{matrix}{{{{{Enc}\left( {{p\; k},m,{\Gamma^{KP}:=\left\{ {\left. \left( {t,{{\overset{\rightarrow}{x}}_{t}^{KP}:={\left( {x_{t,1}^{KP},\ldots \;,x_{t,n_{t}^{KP}}^{KP}} \right) \in {R^{n_{t}^{KP}}\backslash \left\{ \overset{\rightarrow}{0} \right\}}}}} \right) \middle| {1 \leq t \leq d^{KP}} \right.,{x_{t,1}^{KP}:=1}} \right\}},{S^{CP}:=\left( {M^{CP},\rho^{CP}} \right)}} \right)}:\omega^{KP}},{\zeta \overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R},{\phi_{0}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R^{z_{0}}},{{{\overset{\rightarrow}{\phi}}_{t}^{KP}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}{R^{z_{t}^{KP}}\mspace{14mu} {for}\mspace{14mu} \left( {t,x_{t}^{KP}} \right)}} \in \Gamma},{{\overset{\rightarrow}{f}}^{CP}\overset{\mspace{25mu} R\mspace{11mu}}{\leftarrow}R^{rCP}},{\left( {\overset{\_}{s}}^{CP} \right)^{T}:={\left( {s_{1}^{CP},\ldots \;,s_{L^{CP}}^{CP}} \right)^{T}:={M^{CP} \cdot \left( {\overset{\rightarrow}{f}}^{CP} \right)^{T}}}},{s_{0}^{CP}:={\overset{\rightarrow}{1} \cdot \left( {\overset{\rightarrow}{f}}^{CP} \right)^{T}}},{c_{0}:={\left( {\omega^{KP},{- s_{0}^{CP}},\overset{\overset{u_{0}}{}}{0^{u_{0}}},\zeta,\overset{\overset{w_{0}}{}}{0^{w_{0}}},\overset{\overset{z_{0}}{}}{\phi_{0,1},\ldots \;,\phi_{0,z_{0}}}} \right)B_{0}}},{{{for}\mspace{14mu} \left( {t,{\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \in \Gamma^{KP}},{c_{t}^{KP}:={\overset{\overset{n_{t}^{KP}}{}}{\left( {{\omega^{KP}{\overset{\rightarrow}{x}}_{t}^{KP}},} \right.}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}}}}},\overset{\overset{w_{t}^{KP}}{}}{0^{w_{t}^{KP}}},{\overset{\overset{z_{t}^{KP}}{}}{\left. \phi_{t}^{KP} \right)}B_{t}^{KP}}}{{{{for}\mspace{14mu} i} = 1},\ldots \;,L^{CP},{{{if}\mspace{14mu} {\rho^{CP}(i)}} = \left( {t,{{\overset{\rightarrow}{v}}_{i}^{CP}:={\left( {v_{i,1}^{CP},\ldots \;,v_{i,n_{t}^{CP}}^{CP}} \right) \in {R^{n_{t}^{CP}}\backslash \left\{ \overset{\rightarrow}{0} \right\}}}}} \right)},{\theta_{i}^{CP}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R},{{\overset{\rightarrow}{\phi}}_{i}^{CP}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R^{z_{t}^{CP}}},{c_{i}^{CP}:={\overset{\overset{n_{t}^{CP}}{}}{\left( {{{s_{i}^{CP}{\overset{\rightarrow}{e}}_{t,1}^{CP}} + {\theta_{i}^{CP}v_{i}^{CP}}},} \right.}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}}}}},\overset{\overset{w_{t}^{CP}}{}}{0^{w_{i}^{CP}}},{\overset{\overset{z_{t}^{CP}}{}}{\left. {\overset{\_}{\phi}}_{i}^{CP} \right)}B_{t}^{CP}},{{{if}\mspace{14mu} {\rho^{CP}(i)}} = {\left( {t,v_{i}^{CP}} \right)}},{\phi_{i}^{CP}\overset{\mspace{14mu} U\mspace{11mu}}{\leftarrow}R^{z_{t}^{CP}}},{c_{i}^{CP}:={\overset{\overset{n_{t}^{CP}}{}}{\left( {{s_{i}^{CP}{\overset{\rightarrow}{v}}_{i}^{CP}},} \right.}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}}}}},\overset{\overset{w_{t}^{CP}}{}}{0^{w_{i}^{CP}}},{\overset{\overset{z_{t}^{CP}}{}}{\left. {\overset{\_}{\phi}}_{i}^{CP} \right)}B_{t}^{CP}},{c_{d + 1}:={g_{t}^{\zeta}m}},{{{return}\mspace{14mu} {ct}_{({\Gamma^{KP},S^{CP}})}}:={\left( {{c_{0};\Gamma^{KP}},{{{\left\{ c_{t}^{KP} \right\} \left( {t,{\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \in \Gamma^{KP}};S^{CP}},c_{1}^{CP},\ldots \;,{c_{L}^{CP};c_{d + 1}}} \right).}}}} & \left\lbrack {{Formula}\mspace{14mu} 168} \right\rbrack\end{matrix}$

$\begin{matrix}{{{\left. {{{Dec}\left( {{p\; k},{{sk}_{({S^{KP},\Gamma^{CP}})}:=\left( {{k_{0}^{*};S^{KP}},k_{1}^{*{KP}},\ldots \;,{k_{L^{KP}}^{*{KP}};\Gamma^{CP}},\left\{ k_{t}^{*{CP}} \right\}} \right)_{{({t,{\overset{\rightarrow}{x}}_{t}^{CP}})} \in \Gamma^{CP}}}} \right)},{{ct}_{({\Gamma^{KP},S^{CP}})}:=\left( {{c_{0};\Gamma^{KP}},{\left\{ c_{t}^{KP} \right\}_{{({t,{\overset{\rightarrow}{x}}_{t}^{KP}})} \in \Gamma^{KP}};S^{CP}},c_{1}^{CP},\ldots \;,{c_{L^{CP}}^{CP};c_{d + 1}}} \right)}} \right):{{If}\mspace{14mu} S^{KP}}}:={{\left( {M^{KP},\rho^{KP}} \right)\mspace{14mu} {accepts}\mspace{14mu} \Gamma^{KP}}:=\left\{ \left( {t,{\overset{\rightarrow}{x}}_{t}^{KP}} \right) \right\}}}{{{{and}\mspace{14mu} S^{CP}}:={\left( {M^{CP},\rho^{CP}} \right)\mspace{14mu} {accepts}\mspace{14mu} {\Gamma^{CP}:\left\{ \left( {t,{\overset{\rightarrow}{x}}_{t}^{CP}} \right) \right\}}}},{{then}\mspace{14mu} {compute}\mspace{14mu} \left( {I^{KP},\left\{ \alpha_{i}^{KP} \right\}_{i \in I^{KP}}} \right)\mspace{14mu} {and}\mspace{14mu} \left( {I^{CP},\left\{ \alpha_{i}^{CP} \right\}_{i \in I^{CP}}} \right)\mspace{14mu} {such}\mspace{14mu} {that}}}{{\overset{\rightarrow}{1} = {\sum\limits_{i \in I}^{\;}{\alpha_{i}^{KP}M_{i}^{KP}}}},{{where}\mspace{14mu} M_{i}^{KP}\mspace{14mu} {is}\mspace{14mu} {the}\mspace{14mu} i\text{-}{th}\mspace{14mu} {row}\mspace{14mu} {of}\mspace{14mu} M^{KP}},{and}}{I^{KP} \subseteq \left\{ {{i \in {\left\{ {1,\ldots \;,L^{KP}} \right\} \left. {\left\lbrack {{\rho^{KP}(i)} = {{{\left( {t,{\overset{\rightarrow}{v}}_{i}^{KP}} \right)\bigwedge\left( {t,{\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \in {{\Gamma^{KP}\bigwedge{\overset{\rightarrow}{v}}_{i}^{KP}} \cdot {\overset{\rightarrow}{x}}_{t}^{KP}}} = 0}} \right\rbrack\bigvee\left\lbrack {{\rho^{KP}(i)} = {{{\left( {t,{\overset{\rightarrow}{v}}_{i}^{KP}} \right)\bigwedge\left( {t,{\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \in {{{\Gamma^{KP}\bigwedge{\overset{\rightarrow}{v}}_{i}^{KP}} \cdot {\overset{\rightarrow}{x}}_{t}^{KP}} \neq 0}}}} \right\rbrack} \right\}}},{{{and}\overset{\rightarrow}{1}} = {\sum\limits_{i \in I}^{\;}{\alpha_{i}^{CP}M_{i}^{CP}}}},{{where}\mspace{14mu} M_{i}^{CP}\mspace{14mu} {is}\mspace{14mu} {the}\mspace{14mu} i\text{-}{th}\mspace{14mu} {row}\mspace{14mu} {of}\mspace{14mu} M^{CP}},{{{and}I^{CP}} \subseteq \left\{ {i \in {\left\{ {1,\ldots \;,L^{CP}} \right\} {{{\left\lbrack {{\rho^{CP}(i)} = {{{\left( {t,{\overset{\rightarrow}{v}}_{i}^{CP}} \right)\bigwedge\left( {t,{\overset{\rightarrow}{x}}_{t}^{CP}} \right)} \in {{\Gamma^{CP}\bigwedge{\overset{\rightarrow}{v}}_{i}^{CP}} \cdot {\overset{\rightarrow}{x}}_{t}^{CP}}} = 0}} \right\rbrack\bigvee\left\lbrack {\rho^{CP}\left. \quad{(i) = {{{\left( {t,{\overset{\rightarrow}{v}}_{i}^{CP}} \right)\bigwedge\left( {t,{\overset{\rightarrow}{x}}_{t}^{CP}} \right)} \in {{{\Gamma^{CP}\bigwedge{\overset{\rightarrow}{v}}_{i}^{CP}} \cdot {\overset{\rightarrow}{x}}_{t}^{CP}} \neq 0}}}} \right\rbrack} \right\}},{K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {({t,{\overset{\rightarrow}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{\alpha_{i}^{KP} \cdot {\prod\limits_{{i \in {I^{KP}\bigwedge{\rho^{KP}{(i)}}}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{KP}})}}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{\rightarrow}{v}}_{i}^{KP} \cdot {\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {({t,{\overset{\rightarrow}{v}}_{i}^{CP}})}}\; {{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}{\alpha_{i}^{CP} \cdot {\prod\limits_{{i \in {I^{CP}\bigwedge{\rho^{CP}{(i)}}}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{CP}})}}}\; {e{\quad{{\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right){\alpha_{i}^{CP}/\left( {{\overset{\rightarrow}{v}}_{i}^{CP} \cdot {\overset{\rightarrow}{x}}_{t}^{CP}} \right)}},{{{return}\mspace{14mu} m^{\prime}}:={c_{d + 1}/{K.}}}}}}}}}}}}}}}}}}}}}} \right.}} \right.}} & \left\lbrack {{Formula}\mspace{14mu} 169} \right\rbrack\end{matrix}$

The cryptographic process in the above description can be adopted forauthority delegation. Authority delegation means that a person having adecryption key generates a lower-level decryption key having weakerauthority than the decryption key of his or her own. Weaker authoritymeans that encrypted data that the decryption key can decrypt islimited.

For example, in the first hierarchical layer (highest order), basesB_(t) and B*_(t) for t=1 are used, in the second hierarchical layer,bases B_(t) and B*_(t) for t=1, 2 are used, . . . , in the k-thhierarchical layer, bases B_(t) and B*_(t) for t−1, . . . , k are used.As the bases B_(t) and B*_(t) to be used increase, a larger number ofpieces of attribute information are set. Accordingly, authority of thedecryption key is limited more.

The hardware configuration of the cryptographic processing system 10(the key generation device 100, the encryption device 200, and thedecryption device 300) in the above embodiments will be described.

FIG. 13 is a diagram showing an example of the hardware configuration ofeach of the key generation device 100, encryption device 200, anddecryption device 300.

As shown in FIG. 13, each of the key generation device 100, encryptiondevice 200, and decryption device 300 includes a CPU 911 (also referredto as a Central Processing Unit, central processing device, processingdevice, computation device, microprocessor, microcomputer, or processor)which executes programs. The CPU 911 is connected to the ROM 913, theRAM 914, the LCD 901 (Liquid Crystal Display), the keyboard 902 (K/B),the communication board 915, and the magnetic disk device 920 via a bus912, and controls these hardware devices. In place of the magnetic diskdevice 920 (fixed disk device), a storage device such as an optical diskdevice or memory card read/write device may be connected. The magneticdisk device 920 is connected via a predetermined fixed disk interface.

The ROM 913 and the magnetic disk device 920 are examples of anonvolatile memory. The RAM 914 is an example of a volatile memory. TheROM 913, the RAM 914, and the magnetic disk device 920 are examples ofthe storage device (memory). The keyboard 902 and the communicationboard 915 are examples of an input device. The communication board 915is an example of a communication device. Furthermore, the LCD 901 is anexample of a display device.

The magnetic disk device 920, ROM 913, or the like stores an operatingsystem 921 (OS), a window system 922, programs 923, and files 924. TheCPU 911, the operating system 921, and the window system 922 executeeach program of the programs 923.

The programs 923 store software and programs that execute the functionsdescribed as the “master key generation part 110”, “information inputpart 130”, “decryption key generation part 140”, “key distribution part150”, “public parameter acquisition part 210”, “information input part220”, “encrypted data generation part 230”, “data transmission part240”, “decryption key acquisition part 310”, “data reception part 320”,“span program calculation part 330”, “complementary coefficientcalculation part 340”, “pairing operation part 350”, “messagecalculation part 360”, and the like in the above description. Theprograms 923 store other programs as well. The programs are read andexecuted by the CPU 911.

The files 924 store information, data, signal values, variable values,and parameters such as the “public parameters pk”, “master key sk”,“encrypted data ct_((ΓKP,SCP))”, “decryption key sk_((SKP,ΓCP))”,“access structures S^(KP), S^(CP)”, “attribute sets Γ^(KP), Γ^(CP)”,“message m”, and the like of the above explanation, as the items of a“file” and “database”. The “file” and “database” are stored in arecording medium such as a disk or memory. The information, data, signalvalues, variable values, and parameters stored in the recording mediumsuch as the disk or memory are read out to the main memory or cachememory by the CPU 911 through a read/write circuit, and are used for theoperations of the CPU 911 such as extraction, search, look-up,comparison, computation, calculation, process, output, print, anddisplay. The information, data, signal values, variable values, andparameters are temporarily stored in the main memory, cache memory, orbuffer memory during the operations of the CPU 1911 includingextraction, search, look-up, comparison, computation, calculation,process, output, print, and display.

The arrows of the flowcharts in the above explanation mainly indicateinput/output of data and signals. The data and signal values are storedin the memory of the RAM 914, the recording medium such as an opticaldisk, or in an IC chip. The data and signals are transmitted online viaa transmission medium such as the bus 912, signal lines, or cables, orelectric waves.

The “part” in the above explanation may be a “circuit”, “device”,“equipment”, “means” or “function”; or a “step”, “procedure”, or“process”. The “device” may be a “circuit”, “equipment”, “means”, or“function”; or a “step”, “procedure”, or “process”. The “process” may bea “step”. Namely, the “part” may be implemented as firmware stored inthe ROM 913. Alternatively, the “part” may be implemented by onlysoftware; by only hardware such as an element, a device, a substrate, ora wiring line; by a combination of software and hardware; or furthermoreby a combination of software, hardware, and firmware. The firmware andsoftware are stored, as programs, in the recording medium such as theROM 913. The program is read by the CPU 911 and executed by the CPU 911.Namely, the program causes the computer to function as a “part”described above. Alternatively, the program causes the computer or thelike to execute the procedure and method of the “part” described above.

REFERENCE SIGNS LIST

-   -   10: cryptographic processing system; 100: key generation device;        110: master key generation part; 120: master key storage part;        130: information input part; 131: KP information input part;        132: CP information input part; 140: decryption key generation        part; 141: f vector generation part; 142: s vector generation        part; 143: random number generation part; 144: main decryption        key generation part; 145: KP decryption key generation part;        146: CP decryption key generation part; 150: key distribution        part; 200: encryption device; 210: public parameter acquisition        part; 220: information input part; 221: KP information input        part; 222: CP information input part; 223: message input part;        230: encrypted data generation part; 231: f vector generation        part; 232: s vector generation part; 233: random number        generation part; 234: main encrypted data generation part; 235:        KP encrypted data generation part; 236: CP encrypted data        generation part; 237: message encrypted data generation part;        240: data transmission part; 300: decryption device; 310:        decryption key acquisition part; 320: data reception part; 330:        span program calculation part; 331: KP span program calculation        part; 332: CP span program calculation part; 340: complementary        coefficient calculation part; 341: KP complementary coefficient        calculation part; 342: CP complementary coefficient calculation        part; 350: pairing operation part; 360: message calculation part

1. A cryptographic processing system comprising a key generation device,an encryption device, and a decryption device, and serving to execute acryptographic process using a basis B₀ and a basis B₀*, a basis B_(t)^(KP) a basis B*_(t) ^(KP) for each integer t=1, . . . , d^(KP) (d^(KP)is an integer of 1 or more), and a basis B_(t) ^(CP) and a basis B*_(t)^(CP) for each integer t=1, . . . , d^(CP) (d^(CP) is an integer of 1 ormore), wherein the key generation device includes a first KP informationinput part which takes as input, a variable ρ^(KP)(i) for each integeri=1, . . . , L^(KP) (L^(KP) is an integer of 1 or more), which variableρ^(KP)(i) is either one of a positive tuple (t, v^(→) _(i) ^(KP)) and anegative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP):=(v_(i,i′) ^(KP))(i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) isan integer of 1 or more), and a predetermined matrix M^(KP) havingL^(KP) rows and r^(KP) columns (r^(KP) is an integer of 1 or more), afirst CP information input part which takes as input, an attribute setΓ^(CP) having the identification information t and an attribute vectorx^(→) _(t) ^(CP):=(x_(t,i′) ^(CP)) (i′=1, . . . , n_(t) ^(CP) wheren_(t) ^(CP) is an integer of 1 or more) for at least one integer t=1, .. . , d^(CP), a main decryption key generation part which generates anelement k*₀ by setting a value −s₀ ^(KP)(s₀ ^(KP):=h^(→KP)·(f^(→KP))^(T)where h^(→KP) and f^(→KP) are vectors each having r^(KP) pieces ofelements) as a coefficient for a basis vector b*_(0,p) (p is apredetermined value) of the basis B*₀, by setting a random number δ^(CP)as a coefficient for a basis vector b*_(0,p′) (p′ is a predeterminedvalue different from prescribed p), and by setting a predetermined valueκ as a coefficient for a basis vector b*_(0,q) (q is a predeterminedvalue different from the prescribed p and prescribed p′), a KPdecryption key generation part which generates an element k*_(i) ^(KP)for each integer i=1 . . . , L^(KP), based on a column vector(s^(→KP))^(T):=(s₁ ^(KP), . . . , s_(i) ^(KP))^(T):=M^(KP)·(f^(→KP))^(T)(i=L^(KP)) generated based on prescribed f^(→KP) and the matrix M^(KP)which is inputted by the first KP information input part; and a randomnumber θ_(i) ^(KP) (i=1, . . . , L^(KP)), the KP decryption keygeneration part being configured to generate the element k*_(i) ^(KP),when the variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP) is apositive tuple (t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)+θ_(i)^(KP)v_(i,1) ^(KP) as a coefficient for a basis vector b*_(t,1) ^(KP) ofthe basis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(KP)v_(i,1) ^(KP) as a coefficientfor a basis vector b*_(t,i′) ^(KP) indicated by the identificationinformation t and by each integer i′=2, . . . , n_(t) ^(KP), and whenthe variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for the basis vector b*_(t,i′) ^(KP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(KP), and a CP decryption key generation part whichgenerates an element k*_(t) ^(CP) concerning each identificationinformation t included in the attribute set Γ^(CP) inputted by the firstCP information input part, the CP decryption key generation part beingconfigured to generate the element k*_(t) ^(CP) by setting x_(t,i′)^(CP) multiplied by the random number δ^(CP) as a coefficient for abasis vector b*_(t,i′) ^(CP) (i′=1, . . . , n_(t) ^(CP)) of the basisB*_(t) ^(CP), wherein the encryption device includes a second KPinformation input part which takes as input, an attribute set Γ^(KP)having the identification information t and an attribute vector x^(→)_(t) ^(KP):=(x_(t,i′) ^(KP))(i′1, . . . , n_(t) ^(KP)) for at least oneinteger t=1, . . . , d^(KP), a second CP information input part whichtakes as input, a variable ρ^(CP)(i) for each integer i=1, . . . ,L^(CP) (L^(CP) is an integer of 1 or more), which variable ρ^(CP)(i) iseither one of a positive tuple (t, v^(→) _(i) ^(CP)) and a negativetuple

(t, v^(→) _(i) ^(CP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector t, v^(→) _(i)^(CP):=(v_(i,i′) ^(CP)) (i′=1, . . . , n_(t) ^(CP)), and a predeterminedmatrix M^(CP) having L^(CP) rows and r^(CP) columns (r^(CP) is aninteger of 1 or more), a main encrypted data generation part whichgenerates an element c₀ by setting a random number ω^(KP) as acoefficient for a basis vector b_(0,p) of the basis B₀, by setting avalue −s₀ ^(CP)(s₀ ^(CP):=h^(→CP)·(f^(→CP))^(T) where h^(→CP) andf^(→CP) are vectors each having r^(CP) pieces of elements) as acoefficient for a basis vector b_(0,p′) of the basis B₀, and by settinga random number ζ as a coefficient for a basis vector b_(0,q), a KPencrypted data generation part which generates an element c_(t) ^(KP)concerning each identification information t included in the attributeset Γ^(KP) inputted by the second KP information input part, the KPencrypted data generation part being configured to generate the elementc_(t) ^(KP) by setting x_(t,i′) ^(KP) multiplied by the random numberω^(KP) as a coefficient for a basis vector b_(t,i′) ^(KP) (i′=1, . . . ,n_(t)) of the basis B_(t) ^(KP), and a CP encrypted data generation partwhich generates an element c_(i) ^(CP) for each integer i=1 . . . ,L^(CP), based on a column vector (s^(→CP))^(T):=(s₁ ^(CP), . . . , s_(i)^(CP))^(T):=M^(CP)·(f^(→CP))^(T) (i=L^(CP)) generated based on theprescribed f^(→CP) and the matrix M^(CP) which is inputted by the secondCP information input part; and a random number θ_(i) ^(CP) (i=1, . . . ,L^(CP)), the CP encrypted data generation part being configured togenerate the element c_(i) ^(CP), when the variable ρ^(CP)(i) for eachinteger i=1, . . . , L^(CP) is a positive tuple (t, v^(→) _(i) ^(CP)),by setting s_(i) ^(CP)+θ_(i) ^(CP)v_(i,1) ^(CP) as a coefficient for abasis vector b_(t,1) ^(CP) of the basis B_(t) ^(CP) indicated byidentification information t of the positive tuple, and by setting θ_(i)^(CP)v_(i,i′) ^(CP) as a coefficient for a basis vector b_(t,i′) ^(CP)indicated by the identification information t and by each integer i′=2,. . . , n_(t) ^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for the basis vector b_(t,i′) ^(CP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(CP), and wherein the decryption device includes adata acquisition part which acquires encrypted data ct_((ΓKP,SCP))including the element c₀ generated by the main encrypted data generationpart, the element c_(t) ^(KP) generated by the KP encrypted datageneration part, the element c_(i) ^(CP) generated by the CP encrypteddata generation part, the attribute set Γ^(KP), and the variableρ^(CP)(i), a decryption key acquisition part which acquires a decryptionkey sk_((SKP,ΓCP)) including the element k*₀ generated by the maindecryption key generation part, the element k*_(i) ^(KP) generated bythe KP decryption key generation part, the element k*_(t) ^(CP)generated by the CP decryption key generation part, the variableρ^(KP)(i), and the attribute set Γ^(CP), a KP complementary coefficientcalculation part which, based on the attribute set Γ^(KP) included inthe encrypted data ct_((ΓKP,SCP)) acquired by the data acquisition part,and the variable ρ^(KP)(i) included in the decryption key sk_((SKP,ΓCP))acquired by the decryption key acquisition part, specifies, amongintegers i=1, . . . , L^(KP), a set I^(KP) of i for which the variableρ^(KP)(i) is a positive tuple (t, v^(→) _(i) ^(KP)) and with which aninner-product of v^(→) _(i) ^(KP) of the positive tuple and x^(→) _(i)^(KP) included in Γ^(KP) indicated by identification information t ofthe positive tuple becomes 0, and i for which the variable ρ^(KP)(i) isa negative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(KP) of the negative tuple and x^(→) _(t) ^(KP) included in Γ^(KP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(KP) withwhich a total of α_(i) ^(KP)M_(i) ^(KP) for i included in the set I^(KP)specified becomes prescribed h^(→) ^(KP), a CP complementary coefficientcalculation part which, based on the variable ρ^(CP)(i) concerning eachinteger i=1, . . . , L^(CP) included in the encrypted datact_((ΓKP,SCP)), and the attribute set Γ^(CP) included in the decryptionkey sk_((SKP,ΓCP)), specifies, among integers i=1, . . . , L^(CP), a setI^(CP) of i for which the variable ρ^(CP)(i) is a positive tuple (t,v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i) ^(CP) ofthe positive tuple and x^(→) _(t) ^(CP) included in Γ^(CP) indicated byidentification information t of the positive tuple becomes 0, and i forwhich the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i)^(CP) of the negative tuple and x^(→) _(t) ^(CP) included in Γ^(CP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(CP) withwhich a total of α_(i) ^(CP)M_(i) ^(CP) for i included in the set I^(CP)specified becomes the prescribed h^(→) ^(CP), and a pairing operationpart which calculates a value K by conducting a pairing operationindicated in Formula 1 for the elements c₀, c_(t) ^(KP), and c_(i) ^(CP)included in the encrypted data ct_((ΓKP,SCP)), and the elements k*₀,k*_(i) ^(KP), and k*_(t) ^(CP) included in the decryption keysk_((DKP,ΓCP)), based on the set I^(KP) specified by the KPcomplementary coefficient calculation part, on the complementarycoefficient α_(i) ^(KP) calculated by the KP complementary coefficientcalculation part, on the set I^(CP) specified by the CP complementarycoefficient calculation part, and on the complementary coefficient α_(i)^(CP) calculated by the CP complementary coefficient calculation part.$\begin{matrix}{K:={{{e\left( {c_{0},k_{0}^{*}} \right)} \cdot i} \in {I^{KP}\bigwedge{\prod\limits_{{\rho^{KP}{(i)}} = {({t,{\overset{\rightarrow}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{\alpha_{i}^{KP} \cdot i}}}} \in {I^{KP}\bigwedge{\prod\limits_{{\rho^{KP}{(i)}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{KP}})}}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{\rightarrow}{v}}_{i}^{KP} \cdot {\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \cdot i}}}} \in {I^{KP}\bigwedge{\prod\limits_{{\rho^{KP}{(i)}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{KP}})}}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{\rightarrow}{v}}_{i}^{KP} \cdot {\overset{\rightarrow}{x}}_{t}^{KP}} \right)} \cdot i}}}} \in {I^{CP}\bigwedge{\prod\limits_{{\rho^{CP}{(i)}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{CP}})}}}\; {{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}{\alpha_{i}^{CP} \cdot i}}}} \in {I^{CP}\bigwedge{\prod\limits_{{\rho^{CP}{(i)}} = {{({t,{\overset{\rightarrow}{v}}_{i}^{CP}})}}}\; {{e\left( {c_{t}^{CP},k_{i}^{*{CP}}} \right)}{\alpha_{i}^{CP}/\left( {{\overset{\rightarrow}{v}}_{i}^{CP} \cdot {\overset{\rightarrow}{x}}_{t}^{CP}} \right)}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 1} \right\rbrack\end{matrix}$
 2. The cryptographic processing system according to claim1, which executes the cryptographic process using the basis B₀ having atleast a basis vector b_(0,i) (i=1, 2, . . . , 2+u₀, 2+u₀+1, . . . ,2+u₀+1+w₀, . . . , 2+u₀+1+z₀), the basis B*₀ having at least a basisvector b*_(0,i) (i=1, 2, . . . , 2+u₀, 2+u₀+1, . . . , 2+u₀+1+w₀, . . ., 2+u₀+1+z₀), the basis B_(t) ^(KP) (t=1, . . . , d) having at least abasis vector b_(t,i) ^(KP) (i=1, . . . , n_(t) ^(KP), . . . , n_(t)^(KP)+u_(t) ^(KP), . . . , n_(t) ^(KP)+u_(t) ^(KP)+w_(t) ^(KP), . . . ,n_(t) ^(KP)+u_(t) ^(KP)+w_(t) ^(KP)+z_(t) ^(KP)) (u_(t) ^(KP), w_(t)^(KP), and z_(t) ^(KP) are each an integer of 1 or more), the basisB*_(t) ^(KP) (t=1, d^(KP)) having at least a basis vector b*_(t,i) ^(KP)(i=1, . . . , n_(t) ^(KP), . . . , n_(t) ^(KP)+u_(t) ^(KP), . . . ,n_(t) ^(KP)+u_(t) ^(KP)+w_(t) ^(KP), . . . , n_(t) ^(KP)+u_(t)^(KP)+w_(t) ^(KP)+z_(t) ^(KP)), the basis B_(t) ^(CP) (t=1, . . . , d)having at least a basis vector b_(t,i) ^(CP) (i=1, . . . , n_(t) ^(CP),. . . , n_(t) ^(CP)+u_(t) ^(CP), . . . , n_(t) ^(CP)+u_(t) ^(CP)+w_(t)^(CP), . . . , n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+z_(t) ^(CP)) (u_(t)^(CP), w_(t) ^(CP), and z_(t) ^(CP) are each an integer of 1 or more),and the basis B*_(t) ^(CP) (t=1, . . . , d^(CP)) having at least a basisvector b*_(t,i) ^(CP) (i=1, . . . , n_(t) ^(CP), . . . , n_(t)^(CP)+u_(t) ^(CP), . . . , n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP), . . . ,n_(t) ^(CP)+u_(t) ^(CP)+w_(t) ^(CP)+z_(t) ^(CP)), wherein, in the keygeneration device, the main decryption key generation part generates theelement k*₀ indicated in Formula 2 based on the random number δ^(CP), arandom number η_(0,i) (i=1, . . . , w₀), and a predetermined value κ,the KP decryption key generation part generates the element k*_(i) ^(KP)indicated in Formula 3 based on the random number θ_(i) ^(KP) and arandom number ηi,i′^(KP) (i=1, . . . , L^(KP), i′=1, . . . , w_(t)^(KP)) when the variable ρ^(KP)(i) is a positive tuple (t, v^(→) _(i)^(KP)), and generates the element k*_(i) ^(KP) indicated in Formula 4based on the random valuer η_(i,i′) ^(P) (i=1, . . . , L^(KP), i′=1, . .. , w_(t) ^(KP)) when the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), and the CP decryption key generation partgenerates the element k*₀ ^(CP) indicated in Formula 5 based on therandom number δ^(CP) and a random number η_(t,i) ^(CP) (i=1, . . . ,w_(t) ^(CP)), and wherein, in the encryption device, the main encrypteddata generation part generates the element c₀ indicated in Formula 6based on the random number ω^(KP), a random number ζ, and a randomnumber φ_(0,1) (i=1, . . . , z₀), the KP encrypted data generation partgenerates the element c₀ ^(KP) indicated in Formula 7 based on therandom number ω^(KP) and a random number φ_(t,i) ^(KP) (i=1, . . . ,z_(t) ^(KP)), and the CP encrypted data generation part generates theelement c_(i) ^(CP) indicated in Formula 8 based on the random numberθ_(i) ^(CP) and a random number θ_(i,i′) ^(CP) (i=1, . . . , L^(CP),i′=1, . . . , z_(t) ^(CP)) when the variable ρ^(CP)(i) is a positivetuple (t, v^(→CP)), and generates the element c_(i) ^(CP) indicated inFormula 9 based on the random number φ_(i,i′) ^(CP) (i=1, . . . ,L^(CP), i′=1, . . . , z_(t) ^(CP)) when the variable ρ^(CP)(i) is anegative tuple

(t, v^(→) _(i) ^(CP)). $\begin{matrix}{k_{0}^{*}:={\left( {{- s_{0}^{KP}},\delta^{CP},\overset{\overset{u_{0}}{}}{0^{u_{0}}},1,{\overset{\overset{w_{0}}{}}{\eta_{0,1},\ldots \;,\eta_{0,w_{0}},}\overset{\overset{z_{0}}{}}{0^{z_{0}}}}} \right)B_{0}^{*}}} & \left\lbrack {{Formula}\mspace{14mu} 2} \right\rbrack \\{k_{i}^{*{KP}}:={\left( {\overset{\overset{n_{t}^{KP}}{}}{{s_{i}^{KP} + {\theta_{i}^{KP}v_{i,1}^{KP}}},{\theta_{i}^{KP}v_{i,2}^{KP}},\ldots \;,{\theta_{i}^{KP}v_{i,n_{t}^{KP}}^{KP}}},\overset{\overset{u_{t}^{KP}}{}}{0u_{t}^{KP}},\overset{\overset{w_{t}^{KP}}{}}{\eta_{i,1}^{KP},\ldots \;,\eta_{i,w_{t}^{KP}}^{KP}},\overset{\overset{z_{t}^{KP}}{}}{0z_{t}^{KP}}} \right)B_{t}^{*{KP}}}} & \left\lbrack {{Formula}\mspace{14mu} 3} \right\rbrack\end{matrix}$ $\begin{matrix}{k_{i}^{*{KP}}:={\left( {\overset{\overset{n_{t}^{KP}}{}}{{s_{i}^{KP}v_{i,1}^{KP}},\ldots \;,{s_{i}^{KP}v_{i,n_{t}^{KP}}^{KP}}},\overset{\overset{u_{t}^{KP}}{}}{0u_{t}^{KP}},\overset{\overset{w_{t}^{KP}}{}}{\eta_{i,1}^{KP},\ldots \;,\eta_{i,w_{t}^{KP}}^{KP}},\overset{\overset{z_{t}^{KP}}{}}{0z_{t}^{KP}}} \right)B_{t}^{*{KP}}}} & \left\lbrack {{Formula}\mspace{14mu} 4} \right\rbrack \\{\mspace{79mu} {k_{i}^{*{CP}}:={\left( {\overset{\overset{n_{t}^{CP}}{}}{{\delta^{CP}{\overset{\rightarrow}{x}}_{t}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{\eta_{t,1}^{CP},\ldots \;,\eta_{t,w_{t}^{CP}}^{CP},}\overset{\overset{z_{t}^{KP}}{}}{0^{z_{t}^{KP}}}} \right)B_{t}^{*{CP}}}}} & \left\lbrack {{Formula}\mspace{14mu} 5} \right\rbrack \\{\mspace{79mu} {c_{0}:={\left( {\omega^{KP},{- s_{0}^{CP}},{\overset{\overset{u_{0}}{}}{0^{u_{0}},}\zeta},{\overset{\overset{w_{0}}{}}{0^{w_{0}},}\overset{\overset{z_{0}}{}}{\phi_{0,1},\ldots \;,\phi_{0,z_{0}}}}} \right)B_{0}}}} & \left\lbrack {{Formula}\mspace{14mu} 6} \right\rbrack \\{\mspace{76mu} {c_{t}^{KP}:={\left( {{\overset{\overset{n_{t}^{KP}}{}}{{\omega^{KP}{\overset{\rightarrow}{x}}_{t}^{KP}},}\overset{\overset{u_{t}^{KP}}{}}{0^{u_{t}^{KP}},}\overset{\overset{w_{t}^{KP}}{}}{0^{w_{t}^{KP}}}},\overset{\overset{z_{0}}{}}{\phi_{t,1}^{KP},\ldots \;,\phi_{t,z_{t}^{KP}}^{KP}}} \right)B_{t}^{KP}}}} & \left\lbrack {{Formula}\mspace{14mu} 7} \right\rbrack \\{\mspace{76mu} {c_{i}^{CP}:={\begin{pmatrix}\overset{\overset{n_{t}^{CP}}{}}{{s_{i}^{CP} + {\theta_{i}^{CP}v_{i,1}^{CP}}},{\theta_{i}^{CP}v_{i,2}^{CP}},\ldots \;,{\theta_{i}^{CP}v_{i,n_{t}^{CP}}^{CP}},} \\{\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{\; {0^{w_{t}^{CP}},}}\mspace{11mu} \overset{\overset{z_{t}^{CP}}{}}{\phi_{i,1}^{CP},\ldots \;,\phi_{i,z_{t}^{CP}}^{CP}}}\end{pmatrix}B_{t}^{CP}}}} & \left\lbrack {{Formula}\mspace{14mu} 8} \right\rbrack\end{matrix}$ $\begin{matrix}{c_{i}^{CP}:={\left( {\overset{\overset{n_{t}^{CP}}{}}{{s_{i}^{CP}v_{i,1}^{CP}},\ldots \;,{s_{i}^{CP}s_{i,n_{t}^{CP}}^{CP}},}\overset{\overset{u_{t}^{CP}}{}}{0^{u_{t}^{CP}},}\overset{\overset{w_{t}^{CP}}{}}{\; {0^{w_{t}^{CP}},}}\mspace{11mu} \overset{\overset{z_{t}^{CP}}{}}{\phi_{i,1}^{CP},\ldots \;,\phi_{i,z_{t}^{CP}}^{CP}}} \right)B_{t}^{CP}}} & \left\lbrack {{Formula}\mspace{14mu} 9} \right\rbrack\end{matrix}$
 3. The cryptographic processing system according to claim1, wherein the encryption device further comprises a message encrypteddata generation part which generates an element c_(d+1)=g_(T) ^(ζ)mincluding a message m embedded, by using a value g_(T) which satisfiesg_(T)=e(b_(0,i), b*_(0,i)) for the predetermined value i,g_(T)=e(b_(t,i), b*_(t,i)) for each integer t=1, . . . , d^(KP) and apredetermined value i, and g_(T)=e(b_(t,i), b*_(t,i)) for each integert=1, . . . , d^(CP) and the predetermined value i, and wherein, in thedecryption device, the data acquisition part acquires encrypted datact_((ΓKP,SCP)) further including the element c_(d+1), the decryptiondevice further including a message calculation part which calculates themessage m by dividing the element c_(d+1) included in the encrypted datact_((ΓKP,SCP)) by the value K calculated by the pairing operation part.4. A key generation device which generates a decryption keysk_((SKP,ΓCP)), in a cryptographic processing system which executes acryptographic process using a basis B₀ and a basis B₀*, a basis B_(t)^(KP) and a basis B*_(t) ^(KP) for each integer t=1, . . . , d^(KP)(d^(KP) is an integer of 1 or more), and a basis B_(t) ^(CP) and a basisB*_(t) ^(CP) for each integer t=1, . . . , d^(CP) (d^(CP) is an integerof 1 or more), the key generation device comprising: a first KPinformation input part which takes as input, a variable ρ^(KP)(i) foreach integer i=1, . . . , L^(KP) (L^(KP) is an integer of 1 or more),which variable ρ^(KP)(i) is either one of a positive tuple (t, v^(→KP))and a negative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP):=(v_(i,i′) ^(KP)) (i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) isan integer of 1 or more), and a predetermined matrix M^(KP) havingL^(KP) rows and r^(KP) columns (r^(KP) is an integer of 1 or more), afirst CP information input part which takes as input, an attribute setΓ^(CP) having the identification information t and an attribute vectorx^(→) _(t) ^(CP):=(x_(t,i′) ^(CP)) (i′ 1, . . . , n_(t) ^(CP) wheren_(t) ^(CP) is an integer of 1 or more) for at least one integer t=1, .. . , d^(CP); a main decryption key generation part which generates anelement k*₀ of the decryption key sk_((SKP,ΓCP)) by setting a value −s₀^(KP)(s₀ ^(KP)h^(→KP)·(f^(→KP))^(T) where h^(→KP) and f^(→KP) arevectors each having r^(KP) of elements) as a coefficient for a basisvector b*_(0,p) (p is a predetermined value) of the basis B*₀, bysetting a random number δ^(CP) as a coefficient for a basis vectorb*_(0,p′) (p′ is a predetermined value different from prescribed p), andby setting a predetermined value κ as a coefficient for a basis vectorb*_(0,q) (q is a predetermined value different from the prescribed p andprescribed p′); a KP decryption key generation part which generates anelement k*_(i) ^(KP) for each integer i=1 . . . , L^(KP), based on acolumn vector (s^(→KP))^(T):=(s₁ ^(KP), . . . , s_(i)^(KP))^(T):=M^(KP)·(f^(→KP))^(T) (i=L^(KP)) generated based on theprescribed f^(→KP) and the matrix M^(KP) which is inputted by the firstKP information input part; and a random number θ_(i) ^(KP) (i=1, . . . ,L^(KP)), the KP decryption key generation part being configured togenerate the element k*_(i) ^(KP) of the decryption key sk_((SKP,ΓCP)),when the variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP) is apositive tuple (t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)+θ_(i)^(KP)v_(i,1) ^(KP) as a coefficient for a basis vector b*_(t,1) ^(KP) ofthe basis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for a basis vector b*_(t,i′) ^(KP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(KP), and when the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for the basis vector b*_(t,i′) ^(KP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(KP); and a CP decryption key generation part whichgenerates an element k*_(t) ^(CP) concerning each identificationinformation t included in the attribute set Γ^(CP) inputted by the firstCP information input part, the CP decryption key generation part beingconfigured to generate the element k*_(t) ^(CP) of the decryption keysk_((SKP,ΓCP)) by setting x_(t,i′) ^(CP) multiplied by the random numberδ^(CP) as a coefficient for a basis vector b*_(t,i′) ^(CP) (i′=1, . . ., n_(t) ^(CP)) of the basis B*_(t) ^(CP).
 5. An encryption device whichgenerates encrypted data ct_((ΓKP,SCP)), in a cryptographic processingsystem which executes a cryptographic process using a basis B₀ and abasis B₀*, a basis B_(t) ^(KP) and a basis B*_(t) ^(KP) for each integert=1, d^(KP) (d^(KP) is an integer of 1 or more), and a basis B_(t) ^(CP)and a basis B*_(t) ^(CP) for each integer t=1, . . . , d^(CP)(d^(CP) isan integer of 1 or more), the encryption device comprising: a second KPinformation input part which takes as input, an attribute set Γ^(KP)having identification information t and an attribute vector x^(→) _(t)^(KP):=(x_(t,i′) ^(KP)) (i′=1, . . . , n_(t) ^(KP)) for at least oneinteger t=1, . . . , d^(KP); a second CP information input part whichtakes as input, a variable ρ^(CP)(i) for each integer i=1, . . . ,L^(CP) (L^(CP) is an integer of 1 or more), which variable ρ^(CP)(i) iseither one of a positive tuple (t, v^(→) _(i) ^(CP)) and a negativetuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector v^(→) _(i)^(CP):=(v_(i,i′) ^(CP))(i′=1, . . . n_(t) ^(CP)), and a predeterminedmatrix M^(CP) having L^(CP) rows and r^(CP) columns (r^(CP) is aninteger of 1 or more); a main encrypted data generation part whichgenerates an element c₀ of encrypted data ct_((ΓKP,SCP)) by setting arandom number ω^(KP) as a coefficient for a basis vector b_(0,p) of thebasis B₀, by setting a value −s₀ ^(CP)(s₀ ^(CP):=h^(→CP)·(f^(→CP))^(T)where h^(→CP) and r^(→CP) are vectors each having r^(CP) pieces ofelements) as a coefficient for a basis vector b_(0,p′), and by setting arandom number ζ as a coefficient for a basis vector b_(0,q); a KPencrypted data generation part which generates an element c_(t) ^(KP)concerning each identification information t included in the attributeset Γ^(KP) inputted by the second KP information input part, the KPencrypted data generation part being configured to generate the elementc₀ ^(KP) of the encrypted data ct_((ΓKP,SCP)) by setting x_(t,i′) ^(KP)multiplied by the random number ω^(KP) as a coefficient for a basisvector b_(t,i′) ^(KP) (i′=1, . . . , n_(t)) of the basis B_(t) ^(KP);and a CP encrypted data generation part which generates an element c_(i)^(CP) for each integer i=1 . . . , L^(CP), based on a column vector(s^(→CP))^(T):=(s_(i) ^(CP), . . . , s_(i)^(CP))^(T):=M^(CP)·(f^(→CP))^(T) (i=L^(CP)) generated based onprescribed f^(→CP) and the matrix M^(CP) which is inputted by the secondCP information input part; and a random number θ_(i) ^(CP) (i=1, . . . ,L^(CP)), the CP encrypted data generation part being configured togenerate the element c_(i) ^(CP) of the encrypted data ct_((ΓKP,SCP)),when the variable ρ^(CP)(i) for each integer i=1, . . . , L^(CP) is apositive tuple (t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)+θ_(i)^(CP)v_(i,1) ^(CP) as a coefficient for a basis vector b_(t,1) ^(CP) ofthe basis B_(t) ^(CP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for a basis vector b_(t,i′) ^(CP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for the basis vector b_(t,i′) ^(CP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(CP).
 6. A decryption device which decryptsencrypted data ct_((ΓKP,SCP)) with a decryption key sk_((CKP,ΓCP)), in acryptographic processing system which executes a cryptographic processusing a basis B₀ and a basis B₀*, a basis B_(t) ^(KP) and a basis B*_(t)^(KP) for each integer t=1, . . . , d^(KP) (d^(KP) is an integer of 1 ormore), and a basis BP and a basis B*_(t) ^(CP) for each integer t=1, . .. , d^(CP) (d^(CP) is an integer of 1 or more), the decryption devicecomprising: a data acquisition part which acquires the encrypted datact_((ΓKP,SCP)) including an attribute set Γ^(KP) having identificationinformation t and an attribute vector x^(→) _(t) ^(KP):=(x_(t,i′) ^(KP))(i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) is an integer of 1 or more)for at least one integer t=1, . . . , d^(KP), a variable ρ^(CP)(i) foreach integer i=1, . . . , L^(CP) (L^(CP) is an integer of 1 or more),which variable ρ^(CP)(i) is either one of a positive tuple (t, v^(→)_(i) ^(CP)) and a negative tuple

(t, v^(→) _(i) ^(CP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector v^(→) _(i)^(CP):=(v_(i,i′) ^(CP)) (i′=1, . . . , n_(t) ^(CP) where n_(t) ^(CP) isan integer of 1 or more), a predetermined matrix M^(CP) having L^(CP)rows and r^(CP) columns (r^(CP) is an integer of 1 or more), an elementc₀ where a random number ω^(KP) is set as a coefficient for a basisvector b_(0,p) of the basis B₀, a value −s₀ ^(CP)(s₀^(CP):=h^(→CP)·(f^(→CP))^(T) where h^(→CP) and f^(→CP) are vectors eachhaving r^(CP) pieces of elements) is set as a coefficient for a basisvector b_(0,p′), and a random number ζ is set as a coefficient for abasis vector b_(0,q), an element c_(t) ^(KP) concerning eachidentification information t included in the attribute set Γ^(KP) wherex_(t,i′) ^(KP) multiplied by the random number ω^(KP) is set as acoefficient for a basis vector b_(t,i′) ^(KP) (i′=1, . . . , n_(t)) ofthe basis B_(t) ^(KP), and an element c_(i) ^(CP) generated for eachinteger i=1 . . . , L^(CP), based on a column vector (s^(→CP))^(T):=(s₁^(CP), . . . , s_(i) ^(CP))^(T):=M^(CP)·(f^(→CP))^(T) (i=L^(CP))generated based on prescribed f^(→CP) and the matrix M^(CP); and arandom number θ_(i) ^(CP) (i=1, . . . , L^(CP)), wherein, in the elementc_(i) ^(CP), when the variable ρ^(CP)(i) for each integer i=1, . . . ,L^(CP) is a positive tuple (t, v^(→) _(i) ^(CP)), s_(i) ^(CP)+θ_(i)^(CP)v_(i,1) ^(CP) is set as a coefficient for a basis vector b_(t,1)^(CP) of the basis B_(t) ^(CP) indicated by identification information tof the positive tuple, and θ_(i) ^(CP)v_(i),i′^(CP) is set as acoefficient for a basis vector b_(t,i′) ^(CP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), s_(i) ^(CP)v_(i,i′) ^(CP) is set as a coefficientfor the basis vector b_(t,i′) ^(CP) indicated by the identificationinformation t of the negative tuple and by each integer i′=1, . . . ,n_(t) ^(CP); a decryption key acquisition part which acquires adecryption key sk_((SKP,ΓCP)) including a variable ρ^(KP)(i) for eachinteger i=1, . . . , L^(KP) (L^(KP) is an integer of 1 or more), whichvariable ρ^(KP)(i) is either one of a positive tuple (t, v^(→) _(i)^(KP)) and a negative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP):=(v_(i,i′) ^(KP)) (i′=1, . . . , n_(t) ^(KP)), a predeterminedmatrix M^(KP) having L^(KP) rows and r^(KP) columns (r^(KP) is aninteger of 1 or more), an attribute set Γ^(CP) having the identificationinformation t and an attribute vector X^(→) _(t) ^(CP):=(x_(t,i′) ^(CP))(i′=1, . . . , n_(t) ^(CP)) for at least one integer t=1, . . . ,d^(CP), an element k*₀ in which a value −s₀ ^(KP)(s₀^(KP):=h^(→KP)·(f^(→KP))^(T) where h^(→KP) and f^(→KP) are vectors eachhaving r^(KP) pieces of elements) is set as a coefficient for a basisvector b*_(0,p) (p is a predetermined value) of the basis B*₀, a randomnumber δ^(CP) is set as a coefficient for a basis vector b*_(0,p′) (p′is a predetermined value different from prescribed p), and apredetermined value κ is set as a coefficient for a basis vectorb*_(0,q) (q is a predetermined value different from prescribed p and theprescribed p′), an element k*_(i) ^(KP) generated for each integer i=1 .. . , L^(KP), based on a column vector (s^(→KP))^(T):=(s₁ ^(KP), . . . ,s_(i) ^(KP))^(T):=M^(KP)·(f^(→KP))^(T) (i=_(L) ^(KP)) generated based onprescribed f^(→KP) and the matrix M^(KP); and a random number θ_(i)^(KP) (i=1, . . . , L^(KP)), wherein, in the element k*_(i) ^(KP), whenthe variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP) is apositive tuple (t, v^(→) _(i) ^(KP)), s_(i) ^(KP)θ_(i) ^(KP)v_(i,1)^(KP) is set as a coefficient for a basis vector b*_(t,i) ^(KP) of thebasis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and θ_(i) ^(KP)v_(i,i′) ^(KP) is set as a coefficientfor a basis vector b*_(t,i′) ^(KP) indicated by the identificationinformation t and by each integer i′=2, . . . , n_(t) ^(KP), and whenthe variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), s_(i) ^(KP)v_(i,i′) ^(KP) is set as a coefficientfor the basis vector b*_(t,i′) ^(KP) indicated by the identificationinformation t of the negative tuple and by each integer i′=1, . . . ,n_(t) ^(KP), and an element k*_(t) ^(CP) concerning each identificationinformation t included in the attribute set Γ^(CP), and where x_(t,i′)^(CP) multiplied by the random number δ^(CP) is set as a coefficient fora basis vector b*_(t,i′) ^(CP) (i′=1, . . . , n_(t) ^(CP)) of the basisB*_(t) ^(CP); a KP complementary coefficient calculation part which,based on the attribute set Γ^(KP) included in the encrypted datact_((ΓKP,SCP)) acquired by the data acquisition part, and the variableρ^(KP)(i) included in the decryption key sk_((SKP,ΓCP)) acquired by thedecryption key acquisition part, specifies, among integers i=1, . . . ,L^(KP), a set I^(KP) of an integer i for which the variable ρ^(KP)(i) isa positive tuple (t, v^(→) _(i) ^(KP)) and with which an inner-productof v^(→) _(i) ^(KP) of the positive tuple and x^(→) _(t) ^(KP) includedin Γ^(KP) indicated by identification information t of the positivetuple becomes 0, and an integer i for which the variable ρ^(KP)(i) is anegative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(KP) of the negative tuple and x^(→) _(t) ^(KP) included in Γ^(KP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(KP) withwhich a total of α_(i) ^(KP)M_(i) ^(KP) for i included in the set I^(KP)specified becomes prescribed h^(→KP); a CP complementary coefficientcalculation part which, based on the variable ρ^(CP)(i) concerning eachinteger i=1, . . . , L^(CP) included in the encrypted datact_((ΓKP,SCP)), and the attribute set Γ^(CP) included in the decryptionkey sk_((SKP,ΓCP)), specifies, among integers i=1, . . . , L^(CP), a setI^(CP) of i for which the variable ρ^(CP)(i) is a positive tuple (t,v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i) ^(CP) ofthe positive tuple and X^(→) _(t) ^(CP) included in Γ^(CP) indicated byidentification information t of the positive tuple becomes 0, and i forwhich the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(CP) of the negative tuple and x^(→) _(t) ^(CP) included in Γ^(CP)indicated by identification information t of the negative tuple does notbecome 0; and calculates a complementary coefficient α_(i) ^(CP) withwhich a total of α_(i) ^(CP)M_(i) ^(CP) for i included in the set I^(CP)specified becomes prescribed h^(→CP); and a pairing operation part whichcalculates a value K by conducting a pairing operation indicated inFormula 10 for the elements c₀, c_(t) ^(KP), and c_(i) ^(CP) included inthe encrypted data ct_((ΓKP,SCP)), and the elements k*₀, k*_(i) ^(KP),and k*_(t) ^(CP) included in the decryption key sk_((SKP,ΓCP)), based onthe set I^(KP) specified by the KP complementary coefficient calculationpart, on the complementary coefficient α_(i) ^(KP) calculated by the KPcomplementary coefficient calculation part, on the set I^(CP) specifiedby the CP complementary coefficient calculation part, and on thecomplementary coefficient α_(i) ^(CP) calculated by the CP complementarycoefficient calculation part. [Formula  10]$K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)} {\alpha_{i}^{KP} \cdot {\prod\limits_{\quad{\quad{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}}}{{e\left( {c_{t}^{KP}, k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{->}{v}}_{i}^{KP} \cdot {\overset{\_}{x}}_{t}^{KP}} \right)} \cdot {\prod\limits_{\quad{{i \in {{I^{CP}\bigwedge{\rho \;}^{CP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}}\; {{e\left( {c_{t}^{CP}, k_{i}^{*{CP}}} \right)} {\alpha_{i}^{CP} \cdot {\prod\limits_{\quad{\quad{\quad{\quad{{i \in {{I^{CP}\bigwedge {\rho \;}^{CP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}}}}}{\quad\; {\quad{e\left( {c_{t}^{CP}, {k_{i}^{*{CP}} {\quad {\left. \quad \right) {\quad{\alpha_{i}^{CP}/ \left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}} \right.}}}}}}}}}}}}}}$7. A cryptographic processing method which uses a basis B₀ and a basisB₀*, a basis B_(t) ^(KP) and a basis B*_(t) ^(KP) for each integer t=1,. . . , d^(KP) (d^(KP) is an integer of 1 or more), and a basis BP and abasis B*_(t) ^(CP) for each integer t=1, . . . , d^(CP) (d° is aninteger of 1 or more), the cryptographic processing method comprising: afirst KP information input step of, with a key generation device, takingas input, a variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP)(L^(KP) is an integer of 1 or more), which variable ρ^(KP)(i) is eitherone of a positive tuple (t, v^(→) _(i) ^(KP)) and a negative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP):=(i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) is an integer of 1or more), and a predetermined matrix M^(KP) having L^(KP) rows andr^(KP) columns (r^(KP) is an integer of 1 or more); a first CPinformation input step of, with the key generation device, taking asinput, an attribute set Γ^(CP) having the identification information tand an attribute vector x^(→) _(t) ^(CP):=(x_(t,i′) ^(CP)) (i′=1, . . ., n_(t) ^(CP) where n_(t) ^(CP) is an integer of 1 or more) for at leastone integer t=1, . . . , d^(CP); a main decryption key generation stepof, with the key generation device, generating an element k*₀ by settinga value −s₀ ^(KP)(s₀ ^(KP):=h^(→KP)·(f^(→KP))^(T) where h^(→KP) andf^(→KP) are vectors each having r^(KP) pieces of elements) as acoefficient for a basis vector b*_(0,p) (p is a predetermined value) ofthe basis B*₀, by setting a random number δ^(CP) as a coefficient for abasis vector b*_(0,p′) (p′ is a predetermined value different fromprescribed p), and by setting a predetermined value κ as a coefficientfor a basis vector b*_(0,q) (q is a predetermined value different fromthe prescribed p and prescribed p′); a KP decryption key generation stepof, with the key generation device, generating an element k*_(i) ^(KP)for each integer i=1 . . . , L^(KP), based on a column vector(s^(→KP))^(T):=(s₁ ^(KP), . . . , s_(i) ^(KP))^(T):=M^(KP)·(f^(→KP))^(T)(i=L^(KP)) generated based on prescribed f^(→KP) and the matrix M^(KP)which is inputted in the first KP information input step; and a randomnumber θ_(i) ^(KP) (i=1, . . . , L^(KP)), the KP decryption keygeneration step being configured to generate the element k*_(i) ^(KP),when the variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP) is apositive tuple (t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)+θ_(i)^(KP)v_(i,1) ^(KP) as a coefficient for a basis vector b*_(t,1) ^(KP) ofthe basis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for a basis vector b*_(t,i′) ^(KP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(KP), and when the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for the basis vector b*_(t,i′) ^(KP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(KP); a CP decryption key generation step of, withthe key generation device, generating an element k*_(t) ^(CP) concerningeach identification information t included in the attribute set Γ^(CP)inputted in the first CP information input step, the CP decryption keygeneration step being configured to generate the element k*_(t) ^(CP) bysetting x_(t,i′) ^(CP) multiplied by the random number δ^(CP) as acoefficient for a basis vector b*_(t,i′) ^(CP) (i′=1, . . . , n_(t)^(CP)) of the basis B*_(t) ^(CP); a second KP information input step of,with an encryption device, taking as input, an attribute set Γ^(KP)having the identification information t and an attribute vector x^(→)_(t) ^(KP):=(x_(t,i′) ^(KP)) (i′=1, . . . , n_(t) ^(KP)) for at leastone integer t=1, . . . , d^(KP); a second CP information input step of,with the encryption device, taking as input, a variable ρ^(CP)(i) foreach integer i=1, . . . , L^(CP) (L^(CP) is an integer of 1 or more),which variable ρ^(CP)(i) is either one of a positive tuple (t, v^(→)_(i) ^(CP)) and a negative tuple

(t, v^(→) _(i) ^(CP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector v^(→) _(i)^(CP):=(v_(i,i′) ^(CP))(i′=1, . . . , n_(t) ^(CP)), and a predeterminedmatrix M^(CP) having L^(CP) rows and r^(CP) columns (r^(CP) is aninteger of 1 or more); a main encrypted data generation step of, withthe encryption device, generating an element c₀ by setting a randomnumber ω^(KP) as a coefficient for a basis vector b_(0,p) of the basisB₀, by setting a value −s₀ ^(CP)(s₀ ^(CP):=h^(→CP)·(f^(→CP))^(T) whereh^(→CP) and f^(→CP) are vectors each having t^(CP) pieces of elements)as a coefficient for a basis vector b_(0,p′), and by setting a randomnumber ζ as a coefficient for a basis vector b_(0,q); a KP encrypteddata generation step of, with the encryption device, generating anelement c_(t) ^(KP) concerning each identification information tincluded in the attribute set Γ^(KP) inputted in the second KPinformation input step, the KP encrypted data generation step beingconfigured to generate the element c_(t) ^(KP) by setting x_(t,i′) ^(KP)multiplied by the random number ω^(KP) as a coefficient for a basisvector b_(t,i′) ^(KP) (i′=1, . . . , n_(t)) of the basis B_(t) ^(KP); aCP encrypted data generation step of, with the encryption device,generating an element c_(i) ^(CP) for each integer i=1 . . . , L^(CP),based on a column vector (s^(→CP))^(T):=(s₁ ^(CP), . . . , s_(i)^(CP))^(T):=M^(CP)·(f^(→CP))^(T) (i=L^(CP)) generated enerated based onthe prescribed f^(→CP) and the matrix M^(CP) which is inputted in thesecond CP information input step; and a random number θ_(i) ^(CP) (i=1,. . . , L^(CP)), the CP encrypted data generation step being configuredto generate the element c_(i) ^(CP), when the variable ρ^(CP)(i) foreach integer i=1, . . . , L^(CP) is a positive tuple (t, v^(→) _(i)^(CP)), by setting s_(i) ^(CP)+θ_(i) ^(CP)v_(i,1) ^(CP) as a coefficientfor a basis vector b_(t,1) ^(CP) of the basis B_(t) ^(CP) indicated byidentification information t of the positive tuple, and by setting θ_(i)^(CP)v_(i,i′) ^(CP) as a coefficient for a basis vector b_(t,i′) ^(CP)indicated by the identification information t and by each integer i′=2,. . . , n_(t) ^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for the basis vector b_(t,i′) ^(CP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(CP); a data acquisition step of, with a decryptiondevice, acquiring encrypted data ct_((ΓCP,SCP)) including the element c₀generated in the main encrypted data generation step, the element c_(t)^(KP) generated in the KP encrypted data generation step, the elementc_(i) ^(CP) generated in the CP encrypted data generation step, theattribute set Γ^(KP), and the variable ρ^(CP)(i); a decryption keyacquisition step of, with the decryption device, acquiring a decryptionkey sk_((SKP,ΓCP)) including the element k*₀ generated in the maindecryption key generation step, the element k*_(i) ^(KP) generated inthe KP decryption key generation step, the element k*_(t) ^(CP)generated in the CP decryption key generation step, the variableρ^(KP)(i), and the attribute set Γ^(CP); a KP complementary coefficientcalculation step of, with the decryption device, based on the attributeset Γ^(KP) included in the encrypted data ct_((ΓKP,SCP)) acquired in thedata acquisition step, and the variable ρ^(KP)(i) included in thedecryption key sk_((SKP,ΓCP)) acquired in the decryption key acquisitionstep, specifying, among integers i=1, . . . , L^(KP), a set I^(KP) of ifor which the variable ρ^(KP)(i) is a positive tuple (t, v^(→) _(i)^(KP)) and with which an inner-product of v^(→) _(i) ^(KP) of thepositive tuple and x^(→) _(t) ^(KP) included in Γ^(KP) indicated byidentification information t of the positive tuple becomes 0, and i forwhich the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(KP) of the negative tuple and x^(→) _(t) ^(KP) included in Γ^(KP)indicated by identification information t of the negative tuple does notbecome 0; and calculating a complementary coefficient α_(i) ^(KP) withwhich a total of α_(i) ^(KP)M_(i) ^(KP) for i included in the set I^(KP)specified becomes prescribed h^(→KP); a CP complementary coefficientcalculation step of, with the decryption device, based on the variableρ^(CP)(i) concerning each integer i=1, . . . , L^(CP) included in theencrypted data ct_((ΓKP,SCP)), and the attribute set Γ^(CP) included inthe decryption key sk_((SKP,ΓCP)), specifying, among integers i=1, . . ., L^(CP), a set I^(CP) of i for which the variable ρ^(CP)(i) is apositive tuple (t, v^(→) _(i) ^(CP)) and with which an inner-product ofv^(→) _(i) ^(CP) of the positive tuple and x^(→) _(t) ^(CP) included inFCP indicated by identification information t of the positive tuplebecomes 0, and i for which the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i)^(CP) of the negative tuple and x^(→) _(t) ^(CP) included in Γ^(CP)indicated by identification information t of the negative tuple does notbecome 0; and calculating a complementary coefficient α_(i) ^(CP) withwhich a total of α_(i) ^(CP)M_(i) ^(CP) for i included in the set I^(CP)specified becomes the prescribed h^(→CP); and a pairing operation stepof, with the decryption device, calculating a value K by conducting apairing operation indicated in Formula 11 for the elements C₀, c_(t)^(KP), and c_(i) ^(CP) included in the encrypted data ct_((ΓKP,SCP)),and the elements k*₀, k*_(i) ^(KP), and k*_(t) ^(CP) included in thedecryption key sk_((SKP,ΓCP)), based on the set I^(KP) specified in theKP complementary coefficient calculation step, on the complementarycoefficient α_(i) ^(KP) calculated in the KP complementary coefficientcalculation step, on the set I^(CP) specified in the CP complementarycoefficient calculation step, and on the complementary coefficient α_(i)^(CP) calculated in the CP complementary coefficient calculation step.[Formula  11]$K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)} {\alpha_{i}^{KP} \cdot {\quad{\quad{\prod\limits_{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{e\left( {c_{t}^{KP}, k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{->}{v}}_{i}^{KP} \cdot {\overset{\_}{x}}_{t}^{KP}} \right)} \cdot {\quad{\prod\limits_{{i \in {{I^{CP}\bigwedge{\rho \;}^{CP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}\; {{e\left( {c_{t}^{CP}, k_{i}^{*{CP}}} \right)} {\alpha_{i}^{CP} \cdot {\prod\limits_{\quad{\quad{\quad{\quad{{i \in {{I^{CP}\bigwedge {\rho \;}^{CP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}}}}}\; {e\left( {c_{t}^{CP}, {k_{i}^{*{CP}} {\quad{\left. \quad \right) {\quad{\alpha_{i}^{CP}/ \left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}} \right.}}}}}}}}}}}}}}}$8. A cryptographic processing program comprising a key generationprogram, an encryption program, and a decryption program, and serving toexecute a cryptographic process using a basis B₀ and a basis B₀*, abasis B_(t) ^(KP) and a basis B*_(t) ^(KP) for each integer t=1, . . . ,d^(KP) (d^(KP) is an integer of 1 or more), and a basis B_(t) ^(CP) anda basis B*_(t) ^(CP) for each integer t=1, . . . , d^(CP) (d^(CP) is aninteger of 1 or more), wherein the key generation program includescausing a computer to execute a first KP information input process oftaking as input, a variable ρ^(KP)(i) for each integer i=1, . . . ,L^(KP) (L^(KP) is an integer of 1 or more), which variable ρ^(KP)(i) iseither one of a positive tuple (t, v⁴³ _(i) ^(KP)) and a negative tuple

(t, v^(→) _(i) ^(KP)) of identification information t (t is any oneinteger of t=1, . . . , d^(KP)) and an attribute vector v^(→) _(i)^(KP):=(v_(i,i′) ^(KP)) (i′=1, . . . , n_(t) ^(KP) where n_(t) ^(KP) isan integer of 1 or more), and a predetermined matrix M^(KP) havingL^(KP) rows and r^(KP) columns (r^(KP) is an integer of 1 or more), afirst CP information input process of taking as input, an attribute setΓ^(CP) having the identification information t and an attribute vectorx^(→) _(t) ^(CP):=(x_(t,i′) ^(CP)) (i′=1, . . . , n_(t) ^(CP) wheren_(t) ^(CP) is an integer of 1 or more) for at least one integer t=1, .. . , d^(CP), a main decryption key generation process of generating anelement k*₀ by setting a value −s₀ ^(KP)(s₀ ^(KP):=h^(→KP)·(f^(→KP))^(T)where h^(→)and f^(→KP) are vectors each having r^(KP) pieces ofelements) as a coefficient for a basis vector b*_(0,p) (p is apredetermined value) of the basis B*₀, by setting a random number δ^(CP)as a coefficient for a basis vector b*_(0,p′) (p′ is a predeterminedvalue different from prescribed p), and by setting a predetermined valueκ as a coefficient for a basis vector b*_(0,q) (q is a predeterminedvalue different from the prescribed p and prescribed p′), a KPdecryption key generation process of generating an element k*_(i) ^(KP)for each integer i=1 . . . , L^(KP), based on a column vector(s^(→KP))^(T):=(s₁ ^(KP), . . . , s_(i) ^(KP))^(T):=M^(KP)·(f^(→KP))^(T)(i=L^(KP)) generated based on prescribed r^(→KP) and the matrix M^(KP)which is inputted in the first KP information input process; and arandom number θ_(i) ^(KP) (i=1, . . . , L^(KP)), the KP decryption keygeneration process being configured to generate the element k*_(i)^(KP), when the variable ρ^(KP)(i) for each integer i=1, . . . , L^(KP)is a positive tuple (t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)+θ_(i)^(KP)v_(i,1) ^(KP) as a coefficient for a basis vector b*_(t,1) ^(KP) ofthe basis B*_(t) ^(KP) indicated by identification information t of thepositive tuple, and by setting θ_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for a basis vector b*_(t,i′) ^(KP) indicated by theidentification information t and by each integer i′=2, . . . , n_(t)^(KP), and when the variable ρ^(KP)(i) is a negative tuple

(t, v^(→) _(i) ^(KP)), by setting s_(i) ^(KP)v_(i,i′) ^(KP) as acoefficient for the basis vector b*_(t,i′) ^(KP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(KP), and a CP decryption key generation process ofgenerating an element k*_(t) ^(CP) concerning each identificationinformation t included in the attribute set Γ^(CP) inputted in the firstCP information input process, the CP decryption key generation processbeing configured to generate the element k*_(t) ^(CP) by settingx_(t,i′) ^(CP) multiplied by the random number δ^(CP) as a coefficientfor a basis vector b*_(t,i′) ^(CP) (i′=1, . . . , n_(t) ^(CP)) of thebasis B*_(t) ^(CP), wherein the encryption program includes causing thecomputer to execute a second KP information input process of taking asinput, an attribute set Γ^(KP) having the identification information tand an attribute vector x^(→) _(t) ^(KP):=(x_(t,i′) ^(KP)) (i′=1, . . ., n_(t) ^(KP)) for at least one integer t=1, . . . , d^(KP), a second CPinformation input process of taking as input, a variable ρ^(CP)(i) foreach integer i=1, . . . , L^(CP)) (L^(CP) is an integer of 1 or more),which variable ρ^(CP)(i) is either one of a positive tuple (t, v^(→)_(i) ^(CP)) and a negative tuple

(t, v^(→) _(i) ^(CP)) of identification information t (t is any oneinteger of t=1, . . . , d^(CP)) and an attribute vector v^(→) _(i)^(CP):=(v_(i,i′) ^(CP))(i′=1, . . . , n_(t) ^(CP)), and a predeterminedmatrix M^(CP) having L^(CP) rows and r^(CP) columns (r^(CP) is aninteger of 1 or more), a main encrypted data generation process ofgenerating an element c₀ by setting a random number ω^(KP) as acoefficient for a basis vector b_(0,p) of the basis B₀, by setting avalue −s₀ ^(CP)(s₀ ^(CP):=h^(→CP)·(f^(→CP))^(T) where h^(→CP) andf^(→CP) are vectors each having r^(CP) pieces of elements) as acoefficient for a basis vector b_(0,p′), and by setting a random numberζ as a coefficient for a basis vector b_(0,q), a KP encrypted datageneration process of generating an element c_(t) ^(KP) concerning eachidentification information t included in the attribute set Γ^(KP)inputted in the second KP information input process, the KP encrypteddata generation process being configured to generate the element c_(t)^(KP) by setting x_(t,i′) ^(KP) multiplied by the random number ω^(KP)as a coefficient for a basis vector b_(t,i′) ^(KP) (i′=1, . . . , n_(t))of the basis B_(t) ^(KP), and a CP encrypted data generation process ofgenerating an element c_(i) ^(CP) for each integer i=1 . . . , L^(CP),based on a column vector (s^(→CP))^(T):=(s₁ ^(CP), . . . , s_(i)^(CP))^(T):=M^(CP)·(f^(→CP))^(T) (i=L^(CP)) generated based on theprescribed f^(→CP) and the matrix M^(CP) which is inputted in the secondCP information input process; and a random number θ_(i) ^(CP) (i=1, . .. , L^(CP)), the CP encrypted data generation process being configuredto generate the element c_(i) ^(CP), when the variable ρ^(CP)(i) foreach integer i=1, . . . , L^(CP) is a positive tuple (t, v^(→) _(i)^(CP)), by setting s_(i) ^(CP)+θ_(i) ^(CP)v_(i,1) ^(CP) as a coefficientfor a basis vector b_(t,1) ^(CP) of the basis B_(t) ^(CP) indicated byidentification information t of the positive tuple, and by setting θ_(i)^(CP)v_(i,i′) ^(CP) as a coefficient for a basis vector b_(t,i′) ^(CP)indicated by the identification information t and by each integer i′=2,. . . , n_(t) ^(CP), and when the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)), by setting s_(i) ^(CP)v_(i,i′) ^(CP) as acoefficient for the basis vector b_(t,i′) ^(CP) indicated by theidentification information t of the negative tuple and by each integeri′=1, . . . , n_(t) ^(CP), and wherein the decryption program includescausing the computer to execute a data acquisition process of acquiringencrypted data ct_((ΓKP,SCP)) including the element c₀ generated in themain encrypted data generation process, the element c_(t) ^(KP)generated in the KP encrypted data generation process, the element c_(i)^(CP) generated in the CP encrypted data generation process, theattribute set Γ^(KP), and the variable ρ^(CP)(i), a decryption keyacquisition process of acquiring a decryption key sk_((SKP,ΓCP))including the element k*₀ generated in the main decryption keygeneration process, the element k*_(i) ^(KP) generated in the KPdecryption key generation process, the element k*_(t) ^(CP) generated inthe CP decryption key generation process, the variable ρ^(KP)(i), andthe attribute set Γ^(CP), a KP complementary coefficient calculationprocess of, based on the attribute set Γ^(KP) included in the encrypteddata ct_((ΓKP,SCP)) acquired in the data acquisition process, and thevariable ρ^(KP)(i) included in the decryption key sk_((SKP,ΓCP))acquired in the decryption key acquisition part, specifying, amongintegers i=1, . . . , L^(KP), a set I^(KP) of i for which the variableρ^(KP)(i) is a positive tuple (t, v^(→) _(i) ^(KP)) and with which aninner-product of v^(→) _(i) ^(KP) of the positive tuple and x^(→) _(t)^(KP) included in Γ^(KP) indicated by identification information t ofthe positive tuple becomes 0, and i for which the variable ρ^(KP)(i) isa negative tuple

(t, v^(→) _(i) ^(KP)) and with which an inner-product of v^(→) _(i)^(KP) of the negative tuple and x^(→) _(t) ^(KP) included in Γ^(KP)indicated by identification information t of the negative tuple does notbecome 0; and calculating a complementary coefficient α_(i) ^(KP) withwhich a total of α_(i) ^(KP)M_(i) ^(KP) for i included in the set I^(KP)specified becomes prescribed h^(→KP), a CP complementary coefficientcalculation process of, based on the variable ρ^(CP)(i) concerning eachinteger i=1, . . . , L^(CP) included in the encrypted datact_((ΓKP,SCP)), and the attribute set Γ^(CP) included in the decryptionkey sk_((SKP,ΓCP)), specifying, among integers i=1, . . . , L^(CP), aset I^(CP) of i for which the variable ρ^(CP)(i) is a positive tuple (t,v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i) ^(CP) ofthe positive tuple and x^(→) _(t) ^(CP) included in Γ^(CP) indicated byidentification information t of the positive tuple becomes 0, and i forwhich the variable ρ^(CP)(i) is a negative tuple

(t, v^(→) _(i) ^(CP)) and with which an inner-product of v^(→) _(i)^(CP) of the negative tuple and x^(→) _(t) ^(CP) included in Γ^(CP)indicated by identification information t of the negative tuple does notbecome 0; and calculating a complementary coefficient α_(i) ^(CP) withwhich a total of α_(i) ^(CP)M_(i) ^(CP) for i included in the set I^(CP)specified becomes the prescribed h^(→CP), and a pairing operationprocess of calculating a value K by conducting a pairing operationindicated in Formula 12 for the elements c₀, c_(t) ^(KP), and c_(i)^(CP) included in the encrypted data ct_((ΓKP,SCP)), and the elementsk*₀, k*_(i) ^(KP), and k*_(t) ^(CP) included in the decryption keysk_((SKP,ΓCP)), based on the set I^(KP) specified in the KPcomplementary coefficient calculation process, on the complementarycoefficient α_(i) ^(KP) calculated in the KP complementary coefficientcalculation process, on the set I^(CP) specified in the CP complementarycoefficient calculation process, and on the complementary coefficientα_(i) ^(CP) calculated in the CP complementary coefficient calculationprocess. [Formula  12]$K:={{e\left( {c_{0},k_{0}^{*}} \right)} \cdot {\prod\limits_{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{KP}})}}\; {{e\left( {c_{t}^{KP},k_{i}^{*{KP}}} \right)} {\alpha_{i}^{KP} \cdot {\quad{\quad{\prod\limits_{{i \in {{I^{KP}\bigwedge{\rho \;}^{KP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{KP}})}}}{{e\left( {c_{t}^{KP}, k_{i}^{*{KP}}} \right)}{{\alpha_{i}^{KP}/\left( {{\overset{->}{v}}_{i}^{KP} \cdot {\overset{\_}{x}}_{t}^{KP}} \right)} \cdot {\quad{\prod\limits_{{i \in {{I^{CP}\bigwedge{\rho \;}^{CP}}{(i)}}} = {({t,{\overset{->}{v}}_{i}^{CP}})}}\; {{e\left( {c_{t}^{CP}, k_{i}^{*{CP}}} \right)} {\alpha_{i}^{CP} \cdot {\prod\limits_{\quad{\quad{\quad{\quad{{i \in {{I^{CP}\bigwedge {\rho \;}^{CP}}{(i)}}} = {{({t,{\overset{->}{v}}_{i}^{CP}})}}}}}}}\; {e\left( {c_{t}^{CP}, {k_{i}^{*{CP}} {\quad{\left. \quad \right) {\quad{\alpha_{i}^{CP}/ \left( {{\overset{->}{v}}_{i}^{CP} \cdot {\overset{->}{x}}_{t}^{CP}} \right)}}}}}} \right.}}}}}}}}}}}}}}}$